Command Message
Subtechnique · ATTACK:ics:T1691.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T1691.001",
"title": "Command Message",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1691/001",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9",
"external_id": "T1691.001",
"domain": "ics",
"created": "2026-04-20T20:54:16.029Z",
"modified": "2026-10-13T17:48:49.021Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"inhibit-response-function"
],
"source_references": [
{
"source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
"url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
},
{
"source_name": "Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016",
"url": "https://assets.contentstack.io/v3/assets/blt36c2e63521272fdc/blt6a77276749b76a40/607f235992f0063e5c070fff/E-ISAC_SANS_Ukraine_DUC_5%5b73%5d.pdf"
}
]
}Explicit source assertions (6)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:M0810 → mitigates → ATTACK:ics:T1691.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c6c4752-536e-4b96-86d7-7efe88350082
ATTACK:ics:S0604 → uses → ATTACK:ics:T1691.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ce3bd17-de4c-4ff3-9f7d-ae30efae2b58
Anton Cherepanov, ESET June 2017ATTACK:ics:M0807 → mitigates → ATTACK:ics:T1691.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6ebd61b-7845-4694-9860-2e8998f2841f
ATTACK:ics:C0028 → uses → ATTACK:ics:T1691.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ba9ebebf-d5dd-4a5c-b44f-a07cc3ccac8b
Ukraine15 - EISAC - 201603ATTACK:ics:T1691.001 → subtechnique-of → ATTACK:ics:T1691
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cfc97955-3fda-4152-94c6-106f58a5579b
ATTACK:ics:M0814 → mitigates → ATTACK:ics:T1691.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eba478bb-7b76-4889-b82c-eda10826ffcb