Introduction to Hacking
What this domain tests
The exam tests whether you can describe how an attacker progresses against an ICS environment, map activity to MITRE ATT&CK for ICS, and separate authorized testing from unauthorized intrusion. It is not a malware catalog; it is a model of attacker goals, access paths, and the safety consequences of actions in OT.
Core rules
- Reconnaissance includes public information, network scanning, and protocol probing. Active scanning can crash fragile controllers, so OT assessments often start passive.
- Initial access commonly comes through phishing, exposed remote access, vendor connections, weak credentials, and removable media. Supply chain compromise is also in scope.
- Post-access phases include execution, persistence, privilege escalation, discovery, lateral movement, collection, command and control, and ICS-specific impact such as inhibit response function, impair process control, and loss of view or control.
- Authorized work needs written scope, rules of engagement, a safety plan, and coordination with operations. A penetration test that changes setpoints without approval is not acceptable.
- Map each observed behavior to a tactic and technique, then to a control that detects or blocks it.
Worked example
An engineer receives a phishing email, enters credentials on a fake VPN page, and the attacker logs in. From the VPN the attacker reaches an engineering workstation, uses it to send Modbus write requests, and changes a setpoint. Reasoning: initial access is phishing/valid accounts; discovery includes remote system and network scanning; lateral movement is remote services; the Modbus writes map to impair process control. Controls include MFA, VPN device posture, restricting RDP, monitoring engineering workstation behavior, and alerting on unauthorized write function codes.
Traps
- Treating hacking as only malware; valid accounts and misconfiguration are common.
- Running aggressive scans on production OT without approval.
- Ignoring insider, physical, and supply-chain paths.
- Calling any test a penetration test without OT safety constraints and scope.