I85PREP
⌘ K
MITRE ATT&CK Fundamentals study materials
MITRE ATT&CK Fundamentals study resources

MITRE ATT&CK Fundamentals: ATT&CK for Mobile and ATT&CK for ICS

MITRE ATT&CK Fundamentals · Work through your exam, one topic at a time.

All guide sections

ATT&CK for Mobile and ATT&CK for ICS

The ATT&CK for Mobile and ATT&CK for ICS domain tests whether you can choose the right matrix and avoid copying Enterprise mappings into specialized environments. ATT&CK for Mobile covers Android and iOS adversary behavior, including malicious apps, enterprise mobility management abuse, and mobile-specific persistence and collection. ATT&CK for ICS covers industrial control systems and spans IT and operational technology. Its tactics include traditional enterprise goals plus OT-focused goals such as Impair Process Control and Inhibit Response Function, and impact categories such as loss of safety, manipulation of control, and damage to property. Technique IDs, platforms, and data sources differ from Enterprise, so do not copy an Enterprise mapping without checking.

Core rules

  • Select the correct matrix before mapping; IDs are domain-specific.
  • Mobile threats often rely on permissions, profiles, and app-store or sideloading vectors.
  • ICS mappings must account for engineering workstations, PLCs, RTUs, HMIs, and safety systems.
  • OT impact can be physical; confidentiality, integrity, and availability alone may be too narrow.

Worked example

An Android app asks for accessibility services and draws overlays over a banking login. In Mobile, this is a Defense Evasion and Credential Access behavior implemented through a malicious app. Do not map it to an Enterprise technique just because the goal sounds familiar. In ICS, an attacker sending an unauthorized command to a PLC to change a setpoint maps to Impair Process Control, with Unauthorized Command Message (T0855) and Modify Parameter (T0836) as candidate techniques depending on evidence. The procedure note should identify the protocol and device.

Traps

Using Enterprise technique IDs in Mobile or ICS is a frequent error. Assuming ICS impact is only data loss misses safety and physical consequences. Treating mobile malware as a single technique ignores permission and profile abuse. Also, do not map an ICS event without identifying the control-system layer and the observed command.