Adversaries may send unauthorized command messages to instruct control system assets to perform actions outside of their intended functionality, or without the logical preconditions to trigger their expected function. Command messages are used in ICS networks to give direct instructions to control systems devices. If an adversary can send an unauthorized command message to a control system, then it can instruct the control systems device to perform an action outside the normal bounds of the device's actions. An adversary could potentially instruct a control systems device to perform an action that will cause an [Impact](https://attack.mitre.org/tactics/TA0105).(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011) In the Dallas Siren incident, adversaries were able to send command messages to activate tornado alarm systems across the city without an impending tornado or other disaster.(Citation: Zack Whittaker April 2017)(Citation: Benjamin Freed March 2019)

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is related to Distributed Control System (DCS) Controller
is related to Programmable Automation Controller (PAC)
is related to Safety Controller
is related to Control Server
is related to Human-Machine Interface (HMI)
is related to Intelligent Electronic Device (IED)
is related to Remote Terminal Unit (RTU)
is related to Programmable Logic Controller (PLC)
is blocked by Communication Authenticity
is blocked by Validate Program Inputs
is blocked by Filter Network Traffic
is blocked by Software Process and Device Authentication
is blocked by Network Allowlists
is blocked by Detection of Unauthorized Command Message
is blocked by Network Segmentation
Impressum Deutsch Englisch