aol.pm

INCONTROLLER

Software · ATTACK:ics:S1045

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:ics:S1045",
  "title": "INCONTROLLER",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S1045",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--d3aa1058-b1b3-4c29-a3ba-9a9b90ccd93b",
  "external_id": "S1045",
  "domain": "ics",
  "created": "2022-09-28T20:07:40.272Z",
  "modified": "2026-05-12T15:12:00.739Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "PIPEDREAM"
    },
    {
      "source_name": "CISA-AA22-103A",
      "url": "https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"
    },
    {
      "source_name": "Dragos-Pipedream",
      "url": "https://hub.dragos.com/hubfs/116-Whitepapers/Dragos_ChernoviteWP_v2b.pdf?hsLang=en"
    },
    {
      "source_name": "Wylie-22",
      "url": "https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"
    },
    {
      "source_name": "Brubaker-Incontroller",
      "url": "https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"
    },
    {
      "source_name": "Schneider-Incontroller",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SESB-2022-01"
    }
  ]
}

Explicit source assertions (20)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:ics:S1045 → uses → ATTACK:ics:T0846.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--061271f5-0d51-4011-9451-532cd1efedbd

Dragos-Pipedream · Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0861

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--064dfd6f-db5d-48e8-b350-9dd47a270911

CISA-AA22-103A

ATTACK:ics:S1045 → uses → ATTACK:ics:T0869

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d4f2f88-e176-42c7-8258-52b345045662

CISA-AA22-103A

ATTACK:ics:S1045 → uses → ATTACK:ics:T0886

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2867f491-919b-463f-b689-bb3ceb7ae99f

Dragos-Pipedream · Wylie-22 · Brubaker-Incontroller

ATTACK:ics:S1045 → uses → ATTACK:ics:T1692.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f15fa70-7e2d-4ef3-9654-0404e71ac343

CISA-AA22-103A

ATTACK:ics:S1045 → uses → ATTACK:ics:T0884

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40479f3e-d4d2-45f8-893f-f8a4fcf1613c

Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0836

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4dd93fd2-6e6d-4c50-a091-6d6ea6903f1e

Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0858

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51eb15a3-48af-470f-94c0-10f25b366d72

Dragos-Pipedream · Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0843.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--59685dcb-3076-4171-b43f-0ddca6555dc0

Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6681bc38-0b55-4714-b690-c609956b40bf

CISA-AA22-103A · Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0846

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66af47d7-c430-4ac9-8020-fd79b7059037

CISA-AA22-103A · Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0843

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c1eee62-3307-4e25-8a20-919ccd56ec1c

Wylie-22 · Brubaker-Incontroller

ATTACK:ics:S1045 → uses → ATTACK:ics:T0888

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--80a69b56-337d-446a-8167-8b9f63083c4f

CISA-AA22-103A · Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0867

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--868db512-b897-4a54-ae56-ac78f6c93a14

CISA-AA22-103A · Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0846.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--93489277-7107-4bad-a9d1-2013ef471905

Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0845

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b346eec8-de90-407c-b665-387086bb4553

Wylie-22 · Brubaker-Incontroller

ATTACK:ics:S1045 → uses → ATTACK:ics:T0890

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cba8313b-c338-45f7-88ef-a514094882ac

Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0842

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8911566-f622-4a01-b765-514dbbfd8201

Wylie-22

ATTACK:ics:S1045 → uses → ATTACK:ics:T0809

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3923fcf-5580-4c1e-bc55-33f67792cc00

Dragos-Pipedream · Wylie-22 · Brubaker-Incontroller

ATTACK:ics:S1045 → uses → ATTACK:ics:T1694.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcc33052-42c2-485c-903c-cd86e5a87f34

Wylie-22

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.