External Remote Services
Technique · ATTACK:ics:T0822
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T0822",
"title": "External Remote Services",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T0822",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c",
"external_id": "T0822",
"domain": "ics",
"created": "2020-05-21T17:43:26.506Z",
"modified": "2026-10-13T17:48:54.492Z",
"version": "1.1",
"aliases": [
],
"tactics": [
"initial-access"
],
"source_references": [
{
"source_name": "Daniel Oakley, Travis Smith, Tripwire",
"url": "https://attack.mitre.org/wiki/Technique/T1133"
},
{
"source_name": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016",
"url": "https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt6a77276749b76a40/607f235992f0063e5c070fff/E-ISAC_SANS_Ukraine_DUC_5%5b73%5d.pdf"
}
]
}Explicit source assertions (11)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:C0028 → uses → ATTACK:ics:T0822
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00b9e63b-57a7-408e-83d6-fc03535010a6
Booz Allen HamiltonATTACK:ics:M0930 → mitigates → ATTACK:ics:T0822
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--220140ac-d927-4d86-9335-c04aa6ee3c61
Keith Stouffer May 2015ATTACK:ics:C0020 → uses → ATTACK:ics:T0822
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--245c8c36-28e5-4508-a585-7768cb33299a
Marshall Abrams July 2008ATTACK:ics:M0936 → mitigates → ATTACK:ics:T0822
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--276aa6a6-e700-470a-8f72-02537ba7be9d
Keith Stouffer May 2015ATTACK:ics:M0935 → mitigates → ATTACK:ics:T0822
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2daeeaaa-5b4b-4bb7-a94d-78a5749027ca
ATTACK:ics:S1157 → uses → ATTACK:ics:T0822
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66eb9d6f-498b-4a9a-94d3-fe808460bb68
Claroty Fuxnet 2024ATTACK:ics:M0927 → mitigates → ATTACK:ics:T0822
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--98f1d575-a975-42ae-8b00-2c9e22d560d5
ATTACK:ics:M0918 → mitigates → ATTACK:ics:T0822
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a7fbe555-a61b-4b93-bfb2-8e0dd0d6323e
ATTACK:ics:M0942 → mitigates → ATTACK:ics:T0822
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a847aa03-ea56-47d1-8f4e-f9e0dd9707a0
Department of Homeland Security September 2016ATTACK:ics:M0932 → mitigates → ATTACK:ics:T0822
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc35c44a-a90c-48a1-8811-af2618216e42
ATTACK:ics:C0063 → uses → ATTACK:ics:T0822
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e8a72417-2ff1-4bb7-93c2-17fa0c274d3d
CERT Polska