Command Message
Subtechnique · ATTACK:ics:T1692.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T1692.001",
"title": "Command Message",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1692/001",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265",
"external_id": "T1692.001",
"domain": "ics",
"created": "2026-04-20T20:54:17.053Z",
"modified": "2026-10-13T17:48:51.581Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"evasion",
"impair-process-control"
],
"source_references": [
{
"source_name": "Benjamin Freed March 2019",
"url": "https://statescoop.com/tornado-sirens-in-dallas-suburbs-deactivated-after-being-hacked-and-set-off/"
},
{
"source_name": "Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011",
"url": "http://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=6142258"
},
{
"source_name": "Zack Whittaker April 2017",
"url": "https://www.zdnet.com/article/experts-think-they-know-how-dallas-emergency-sirens-were-hacked/"
}
]
}Explicit source assertions (15)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:M0802 → mitigates → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c68501b-8e36-4d75-9e61-7a518a9ca1f2
ATTACK:ics:M0818 → mitigates → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2de38f5e-b97c-498a-a4c9-f13e5d2d233c
ATTACK:ics:S1045 → uses → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f15fa70-7e2d-4ef3-9654-0404e71ac343
CISA-AA22-103AATTACK:ics:M0937 → mitigates → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2f8c9deb-aefe-4fa3-b00c-ec15fd154233
ATTACK:ics:T1692.001 → subtechnique-of → ATTACK:ics:T1692
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2fd35996-196f-4a58-9dab-07f52c74f4d3
ATTACK:ics:M0813 → mitigates → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3003564d-fb12-4509-946b-818e4e5b8431
ATTACK:ics:C0020 → uses → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--41856149-91d5-4815-b50f-8eb371ac5ba6
Marshall Abrams July 2008ATTACK:ics:C0030 → uses → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73eaa82f-9ab0-430d-86b8-64ea85b18c91
FireEye TRITON 2018ATTACK:ics:S1072 → uses → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--898a9eb9-671e-4096-8288-72ffb49e93f3
Industroyer2 Mandiant April 2022 · Industroyer2 Forescout July 2022ATTACK:ics:G1027 → uses → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--abce8e63-b622-441b-9b79-1fdd95da8cff
CISA-AA26-097AATTACK:ics:M0807 → mitigates → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc0e4ff7-ed61-41c0-84ca-66210241c9ce
Department of Homeland Security September 2016ATTACK:ics:S0604 → uses → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc51e6c7-6211-4124-874d-4a5aea2efce0
Anton Cherepanov, ESET June 2017ATTACK:ics:C0028 → uses → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cdc5aea4-1aac-4e6b-86cd-39617629d96b
Ukraine15 - EISAC - 201603ATTACK:ics:C0034 → uses → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cf3d020e-5ca7-4867-a502-654e445cc45c
Mandiant-Sandworm-Ukraine-2022ATTACK:ics:M0930 → mitigates → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd52f382-115f-483a-82c1-bb31fe5d5eb6
Department of Homeland Security September 2016 · Dwight Anderson 2014 · Karen Scarfone; Paul Hoffman September 2009 · Keith Stouffer May 2015