Skip to main content
T0814 Inhibit Response Function covers adversary actions that prevent a controller, protection relay, or safety system from performing its expected response — alarming, shutting down, or protecting equipment.

​
Why it matters

Triton/TRISIS showed that attackers will target safety instrumented systems, not only production setpoints. Inhibiting response can leave a plant running while protections are blind — the worst outcome for physical safety.

​
Typical manifestations

  • Suppressing alarms or forcing “healthy” status to HMIs
  • Blocking protective trip logic or watchdog responses
  • Flooding or disconnecting links so RTUs cannot report (related to availability attacks)
  • Malware that replaces legitimate firmware/logic paths (historical SIS cases)

​
How Reyhford uses the technique

When honeypot traffic or enrichment suggests attempts to disable monitoring, block responses, or abuse protocol features associated with inhibit/stop behaviors (notably on S7 and IEC 104), indicators may carry T0814 tags alongside protocol context. Analysts should correlate T0814-tagged IoCs with real incidents (Triton) and with T0855 write activity on the same sources.