IT/OT Attack Workshop Summary 01 [Attack Scenarios Matching to MITRE CWE and Mapping to MITRE ATT&am

3,192 0
English 简体中文 繁体中文 Tiếng Việt
Summary

This analysis leverages MITRE's Common Weakness Enumeration (CWE) and Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) frameworks to dissect various IT and OT attack scenarios. It distinguishes CWE for cataloging vulnerabilities and ATT&CK for documenting adversary behaviors, then applies these to case studies like malicious macro attacks, false data injection on PLCs, ARP spoofing on HMIs, and DDoS attacks. For each scenario, specific vulnerabilities are matched to relevant CWE entries, such as 'Code Injection' or 'Improper Access Control'. Concurrently, attack vectors and actions are mapped to ATT&CK techniques like 'Malicious File' or 'Network Denial of Service'. This systematic approach provides a structured method for understanding, replicating, and extending cybersecurity case studies by categorizing weaknesses and adversary TTPs.

In this article, I aim to introduce two primary frameworks from MITRE [ Common Weakness Enumeration(CWE) and Adversarial Tactics, Techniques, and Common Knowledge(ATT&CK) ] to consolidate and expand upon the case studies presented in our IT/OT workshop. This will empower researchers and instructors to seamlessly replicate, introduce, extend, enhance, or diversify the case studies by incorporating additional vulnerabilities (CVEs), developing diverse attack tactics, techniques, and procedures (TTPs), or integrating/linking the scenarios with other advanced persistent threats (APTs). In this section, we will cover three main components:

  1. A brief background knowledge overview of MITRE CWE (Common Weakness Enumeration) and MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge), highlighting their differences and relationships.
  2. "Matching" the vulnerabilities illustrated in our attack case study scenarios to the corresponding entries in MITRE CWE.
  3. "Mapping" the attack vectors, actions, and attack paths demonstrated in our attack case study scenarios to the relevant entries in MITRE ATT&CK.
# Author:      Yuancheng Liu
# Created:     2025/11/28
# Version:     v_0.0.3
# Copyright:   Copyright (c) 2025 Liu Yuancheng
# License:     MIT License

In this section we will summarize the IT attack scenario and another 2 OT test cases scenario case study, the attack scenario case studies included are:

 

MITRE-CWE & MITRE-ATT&CK

MITRE Common Weakness Enumeration (CWE) and MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) are two distinct frameworks developed by MITRE, each serving different purposes in the realm of cybersecurity:

  • The CWE is category based frame work focuses on cataloging vulnerabilities and weaknesses (CVE).
  • The ATT&CK is knowledge based frame work focuses on documenting adversary behaviors and techniques (TTP).

 

The main difference and relationship between the MITRE CWE and ATT&CK is shown in the title image.

MITRE CWE (Common Weakness Enumeration)

  • CWE is a community-developed list of common software and hardware weaknesses, faults, and vulnerabilities.
  • CWE provides a standardized taxonomy for categorizing and describing various types of security weaknesses that can lead to vulnerabilities in software and systems.
  • Each CWE entry includes a unique identifier, a description of the weakness, examples, potential consequences, and mitigations.
  • CWE is focused on identifying and classifying vulnerabilities and weaknesses to help organizations understand and address security issues in their software and systems.

 

MITRE CWD Link: https://cwe.mitre.org/index.html

MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge)

  • ATT&CK is a knowledge base maintained by MITRE that documents the tactics, techniques, and procedures (TTPs) used by adversaries during cyberattacks.
  • ATT&CK provides a structured framework for understanding and categorizing adversary behaviors across the entire lifecycle of a cyberattack, from initial reconnaissance to data exfiltration.
  • ATT&CK is organized into a matrix format, with tactics represented along the top row and techniques listed within each tactic.
  • Each technique includes detailed information about how adversaries execute it, potential detection methods, and mitigations.
  • ATT&CK is focused on understanding and defending against real-world cyber threats by mapping out the tactics and techniques used by adversaries.

 

In summary, while both MITRE CWE and MITRE ATT&CK are frameworks developed by MITRE to improve cybersecurity, they serve different purposes: CWE focuses on cataloging vulnerabilities and weaknesses, while ATT&CK focuses on documenting adversary behaviors and techniques. However, they can complement each other in understanding and mitigating cybersecurity risks, as vulnerabilities identified in CWE may be exploited using techniques documented in ATT&CK.

MITRE ATT&CK Link: https://attack.mitre.org/

CVE and MITRE CWE

CVE provides identifiers for specific vulnerabilities, CWE catalogs common weaknesses and vulnerabilities. CWE provides a broader catalog of common types of weaknesses that can lead to CVE(s).CVE entries often reference CWE entries to provide additional context about the underlying weakness being exploited.

CVE (Common Vulnerabilities and Exposures):

  • CVE is a dictionary of publicly disclosed cybersecurity vulnerabilities and exposures. Each CVE ID represents a unique identifier for a specific security vulnerability.
  • CVE IDs are assigned to vulnerabilities by CVE Numbering Authorities (CNAs), which are organizations authorized by MITRE to assign CVE IDs.

 

For example, a CVE entry might describe a specific vulnerability in a software product, along with details on how it can be exploited and potential impacts. The user can track the which CWE the CVE belongs to then find the other similar or related vulnerabilities (CVE) or the user want to search a general type of vulnerabilities he can go to the CWE then find the the detail specific type of CVE(s).

APT and MITRE ATT&CK

MITRE ATT&CK describes adversary behavior and techniques, and APTs are sophisticated cyberattacks that may leverage vulnerabilities, weaknesses, and techniques described by CVE, CWE, and ATT&CK.

APT (Advanced Persistent Threat):

  • APT refers to a sophisticated, long-term cyberattack launched by a well-funded and highly skilled adversary.
  • APTs often involve multiple stages and techniques (TTP), including reconnaissance, initial access, lateral movement, and data exfiltration.

 

While APTs are not directly related to CVE, CWE, they may leverage vulnerabilities identified by CVE, exploit weaknesses cataloged in CWE, and employ techniques described in ATT&CK to achieve their objectives.

MITRE CWE Matching and ATT&CK Mapping

After gaining a basic understanding of MITRE CWE and MITRE ATT&CK, we aim to apply both frameworks to our attack scenario. Given that CWE categorizes vulnerabilities systematically, our search will follow a top-down tree search approach, attempting to "match" the vulnerability with key features described in the CWE taxonomy. Conversely, MITRE ATT&CK, being a knowledge-based system, involves a process of "mapping" to identify detailed Tactics, Techniques, and Procedures (TTPs) utilized within our attack path.

IT Attack Scenario: Malicious Macro and Backdoor Trojan Attack on IT-network

A red team attacker implementing an IT system/network attack via a Malicious Macro MS-Office-Word file (CVE-2015-1641) and phishing email sending program to penetrate multiple layers of firewall defenses and implant a backdoor trojan into the railway system's OT network.

MITRE CWE Matching

CWE-94 CWE Link

  • CWE Name: Improper Control of Generation of Code ('Code Injection')
  • CWE Match: The CVE-2015-1641 can match to the CWE-94: Improper Control of Generation of Code ('Code Injection'). In the case study attack [MS-office Word Malicious Macro attack] scenario, the malicious macro within the MS-Office Word document serves as a form of code injection medium, where the attacker embeds auto-phishing email generation malware into the document to execute malicious actions on the victim's system.
  • CWE Detail: This CWE relates to vulnerabilities where an attacker can cause the target system to generate or execute malicious code due to improper control over code generation.

 

CWE-827 CWE Link

  • CWE Name: Improper Control of Document Type
  • CWE Match: Victim Bob treat the macro enabled document *.docm as a normal *.doc , this weakness security action can match to the CWE-827: Improper Control of Document Type. The phishing email generator camouflaged as a normal document may exploit this weakness to trick users into executing malicious actions by improperly controlling the document type.
  • CWE Detail: This CWE relates to vulnerabilities where an attacker can control the type of document or file being processed, potentially leading to unintended actions or security issues.

 

CWE-494 CWE Link

  • CWE Name: Download of Code Without Integrity Check
  • CWE Match: Victim user Charlie Download update installer from phishing email can match to the CWE-494: Download of Code Without Integrity Check. The fake system software update installer designed to harvest user information and insert the backdoor trojan may exploit this weakness.
  • CWE Detail: This CWE relates to vulnerabilities where an attacker can cause the download of code from the internet without proper integrity checks, potentially allowing the execution of malicious code.

 

CWE-829 CWE Link

  • CWE Name: Inclusion of Functionality from Untrusted Control Sphere
  • CWE Match: Victim user Charlie run the fake update installer can match to CWE-829: Inclusion of Functionality from Untrusted Control Sphere. The executed backdoor trojan enabling remote control of the victim's VM, as well as the other OT attack malware, may exploit this weakness by including malicious functionality from an untrusted source.
  • CWE Detail: This CWE relates to vulnerabilities where an attacker can include functionality from an untrusted source, such as executing code from a malicious DLL or executing commands from an external source.

 

CWE-840 CWE Link

  • CWE Name: Business Logic Errors
  • CWE Match: The network firewall policy control access which only block outside get in but allow the OT network nodes connect out can match to CWE-840: Business Logic Errors. This CWE relates to vulnerabilities where there are errors or flaws in the implementation of business logic, leading to security issues or unintended behavior.
  • CWE Detail: The trojan connector facilitating connection to the trojan for remote control of the victim's VM may exploit this weakness in the way it interacts with the trojan and the victim's system to maintain persistence and control.

 

MITRE ATT&CK Mapping

T1204.002: Malicious File

  • This technique involves adversaries using files with malicious code (MS-Word Macro) to establish initial access to a system. In this scenario, the MS-Office Word document containing the malicious macro serves as the malicious file used to initiate the attack.
  • Link: https://attack.mitre.org/techniques/T1204/002/

 

T1027: Obfuscated Files or Information

  • This technique involves adversaries using various methods to hide or obfuscate the content of files or information. In this scenario, the malicious macro may be obfuscated to evade detection by security tools in the MS-Office Word Malicious Macro attack and used to obfuscate the content of the fake software update installer to evade detection by security tools in the attack scenario2.
  • Link: https://attack.mitre.org/techniques/T1027/

 

T1566.001: Phishing

  • This technique involves adversaries sending phishing emails to trick users into performing actions, such as opening malicious attachments. In this scenario, the phishing email containing the malicious MS-Office Word document is used to lure the victim, Bob, into executing the malicious macro.
  • Link: https://attack.mitre.org/techniques/T1566/001/

 

T1204.002: Malicious File

  • Similar to Scenario 1, this technique involves the use of files with malicious code to establish initial access. The fake software update installer containing the backdoor trojan serves as the malicious file in this scenario.
  • Link: https://attack.mitre.org/techniques/T1204/002/

 

T1021: Remote Services

  • This technique involves adversaries using remote access mechanisms to control systems within a target network. The backdoor trojan enabling remote control of the victim's VM facilitates remote access to the compromised system.
  • Link: https://attack.mitre.org/techniques/T1021/

 

T1573: Encrypted Channel

  • This technique involves adversaries using encrypted channels to communicate with command and control infrastructure. The trojan connector facilitating connection to the trojan for remote control utilize an encrypted channel (https) to communicate with the attacker's C2 infrastructure.
  • Link: https://attack.mitre.org/techniques/T1573/

 

OT Attack Case Study 01: False Data / Command Injection Attack on PLC

Attack Scenario: A hacker (red team member) launch an Operational Technology (OT) Cyber Attack on the programmable logic controllers (PLCs) governing railway train control, with the potential consequence of causing a collision accident between two trains.

MITRE CWE Matching

CWE-77

  • CWE Name: Improper Neutralization of Special Elements used in a Command ('Command Injection')
  • CWE Match: In the case study scenario, the attacker may exploit vulnerabilities in the Modbus communication protocol to forge requests to the PLC from the traffic capture file, injecting false data and commands.
  • CWE Detail: This CWE relates OT product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Link: https://cwe.mitre.org/data/definitions/77.html

 

CWE-400

  • CWE Name: Uncontrolled Resource Consumption ('Resource Exhaustion')
  • CWE Match: In this case study scenario, the attacker may overwhelm the PLC's resources (connected input sensor's value) with false data or commands, causing disruption or manipulation of train control operations.
  • CWE Detail: This CWE involves attackers exploiting weaknesses in the target system's resource management, leading to resource exhaustion and potential denial of service or system instability. Link: https://cwe.mitre.org/data/definitions/400.html

 

MITRE ATT&CK Mapping

T1059.008: Network Device Client Command and Scripting Interpreter

  • FCI and FDI could be part of the broader tactic of "Execution" (TA0002) use the network device client to do the command interpreter attack, which involves techniques used by adversaries to run malicious code on / targeting a victim's system. Within this tactic, "Command and Scripting Interpreter" (T1059) could be considered the closest match, as it involves the exploitation of command-line interpreters, which is similar to the concept of injecting commands.
  • Link: https://attack.mitre.org/techniques/T1059/008/

 

T1573.001: Encrypted Channel: Symmetric Cryptography

  • The attacker use https symmetric cryptography to encrypt communications between the False data injection program and the Red Team C2 system. This technique involves adversaries using symmetric cryptography to establish encrypted channels for command and control (C2) communication.
  • Link: https://attack.mitre.org/techniques/T1573/001/

 

OT Attack Case Study 02: ARP Spoofing Attack on HMI

A hacker (cyber range red team member) launch an ARP Spoofing Attack on the OT system Human Machine Interface (HMI) which caused the part of the Operation Room HQ service offline.

MITRE CWE Matching

CWE-284

  • CWE Name: Improper Access Control
  • CWE Match: In this scenario, the attacker exploits improper access control to broadcast fake ARP messages through the HQ Operation Room's switch and apply Modbus-TCP packet filters, leading to disruption of communication between the HMI and PLCs.
  • CWE Detail: This CWE involves vulnerabilities related to inadequate access control mechanisms, allowing unauthorized users to access or manipulate resources. Link: https://cwe.mitre.org/data/definitions/284.html

 

CWE-494

  • CWE Name: Download of Code Without Integrity Check
  • CWE Match: In this scenario, the attacker may use the Red Team C2 system remote control the victim(maintenance engineer's laptop) to download and execute the packet dropper filter for ARP spoofing without integrity checks by the OT subnet firewall.
  • CWE Detail: This CWE involves vulnerabilities where an attacker can cause the download of code from the internet without proper integrity checks, potentially allowing the execution of malicious code. Link: https://cwe.mitre.org/data/definitions/494.html

 

CWE-300

  • CWE Name: Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
  • CWE Match: In this scenario, the attacker uses a man-in-the-middle tool Ettercap to perform ARP attack by intercepting and modifying ARP messages, leading to the disruption of communication between the HMI and PLCs. The security weakness can match to the CWE-300: Channel Accessible by Non-Endpoint ('Man-in-the-Middle')
  • CWE Detail: This CWE involves vulnerabilities where attackers can intercept or modify communication between two parties without their knowledge. Link: https://cwe.mitre.org/data/definitions/300.html

 

CWE-937

  • CWE Name: OWASP Top Ten 2013 Category A5 - Security Misconfiguration
  • CWE Match: In the scenario, the attacker's ability to bypass firewall detection mechanisms and manipulate subnet's switch and victim's ARP tables, this exploit the security misconfigurations in the firewall and network infrastructure. The security weakness can match to the CWE-937: OWASP Top Ten 2013 Category A5 - Security Misconfiguration
  • CWE Detail: This CWE involves weaknesses related to security misconfigurations, such as default configurations, insecure configurations, or incomplete configurations, which can lead to security vulnerabilities or operational failures. Link: https://cwe.mitre.org/data/definitions/937.html

 

MITRE ATT&CK Mapping

Initial Access (TA0001) > T1562.001: Impair Defenses: Disable or Modify Tools

  • The attacker modifies network traffic using MITM attack tool Ettercap to disrupt communication between the HMI and PLCs, impairing defenses and gaining initial access to the network.
  • Link: https://attack.mitre.org/techniques/T1562/001/

 

Command and Control (TA0002) > T1573.002: Encrypted Channel: Asymmetric Cryptography

 

Impact (TA0004) > T1499.002: Endpoint Denial of Service

  • The attacker disrupts communication between the HMI and PLCs by dropping specific Modbus-TCP communication data, causing the railway Sensor-Signal-HMI in the Operation Room to go offline.
  • Link: https://attack.mitre.org/techniques/T1499/

 

OT Attack Case Study 03: DDoS Attack on PLC

A hacker (cyber range red team member) could potentially launch a DDoS attack targets to the OT Programable Logic Controller which caused interruption on the SCADA-HMI-PLC control chain.

MITRE CWE Matching

CWE-399

  • CWE Name: Resource Management Errors
  • CWE Match: In this scenario, launching multiple DDoS Modbus-TCP requests simultaneously may exploit network resource management errors to overwhelm the targeted HMI-PLC control chain, causing it to become unresponsive or unavailable.
  • CWE Detail: This CWE involves weaknesses related to errors in managing system resources, which can lead to resource exhaustion, denial of service, or other operational disruptions. Link: https://cwe.mitre.org/data/definitions/399.html

 

CWE-284

  • CWE Name: Improper Access Control
  • CWE Match: In this scenario, the attacker's ability to control multiple DDoS attacker programs externally to the railway mini cyber range may involve exploiting weaknesses in access control mechanisms to gain unauthorized access. The production network firewall should have the access control which only all the specific SCADA network node to access the related node(PLC) in the production network.
  • CWE Detail: This CWE involves weaknesses related to insufficient or improper access control mechanisms, which can allow unauthorized entities to access or manipulate sensitive resources. Link: https://cwe.mitre.org/data/definitions/284.html

 

CWE-287

  • CWE Name: Improper Authentication
  • CWE Match: In this scenario, the attacker may exploit weaknesses in authentication mechanisms of the supervision network firewall which allows the DDoS attack programs connect to the Red Team C2 DDoS Attack Management System network which located outside the railway company . The security weakness can match to the CWE-287: Improper Authentication
  • CWE Detail: This CWE involves weaknesses related to insufficient or improper authentication mechanisms, which can allow unauthorized entities to access or manipulate sensitive resources. Link : https://cwe.mitre.org/data/definitions/287.html
  •  

 

MITRE ATT&CK Mapping

Execution (TA0002) > T1046: Network Service Scanning

  • The attacker scans the SCADA network to identify the accessible services and potential targets for the DDoS attack. In this case study scenario, the attacker perform network service scanning to identify the accessible PLC as the target for the DDoS Modbus-TCP requests attack.
  • Link: https://attack.mitre.org/techniques/T1046/

 

Impact (TA0040) > T1498: Network Denial of Service

  • The attacker conducts network denial-of-service attacks to disrupt normal operations or services. In this scenario, the primary impact is the interruption of the normally OT HMI-PLC control chain due to the DDoS Modbus-TCP requests attack.
  • Link: https://attack.mitre.org/techniques/T1498/

 

Thanks for spending time to check the detail, if there is any vulnerabilities you think can match to the MITRE-CWE which I didn't list or any other attack MITRE-ATT&CK-TTPs can apply on the system, please feel free to comment. Many thanks if you can share any of the improvement advice so we can make our work better ~

  RELATED

No related programming articles found. Browse all programming tutorials and articles.

  COMMENTS

0

No comment for this article.