Skip to main content
T0855 is the MITRE ATT&CK for ICS technique describing adversaries sending unauthorized commands to field controllers (PLCs, RTUs) to cause unintended changes in physical processes.

​
What it means

In a legitimate ICS environment, commands flow from authorized engineering workstations or SCADA servers to field devices. An unauthorized command message is any command that originates from an unexpected source, contains unexpected values, or occurs outside of normal operational parameters. Because ICS protocols like Modbus and S7 have no built-in authentication, any device that can reach a field controller on the network can send commands indistinguishable from legitimate operator commands.

​
Why it dominates our data

T0855 accounts for approximately 65% of all MITRE-mapped events in the Reyhford sensor network. This reflects the reality that:
  1. Modbus and S7 write attempts are common — attackers who locate an ICS device frequently attempt to write values after initial reconnaissance
  2. No authentication barrier — write attempts require no credentials, making them trivial to execute
  3. High potential impact — successful command injection can alter physical processes directly

​
Detection and context

In a production environment, T0855 indicators include:
  • Command messages from unexpected source IP addresses
  • Write commands outside of normal maintenance windows
  • Commands targeting registers or coils outside of normal operating ranges
  • High-frequency command sequences inconsistent with normal operations
Reyhford indicators tagged with T0855 represent observed write attempts against our honeypot devices. Each indicator includes the source IP, targeted protocol, function code, and timestamp.
  • T0856 — Spoof Reporting Message (falsifying sensor data)
  • T0855.001 — Brute Force I/O (systematically cycling outputs)
  • T0814 — Inhibit Response Function (preventing safety systems from responding)