Rogue Master
Technique · ATTACK:ics:T0848
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T0848",
"title": "Rogue Master",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T0848",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb",
"external_id": "T0848",
"domain": "ics",
"created": "2020-05-21T17:43:26.506Z",
"modified": "2026-10-13T17:48:50.906Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"initial-access"
],
"source_references": [
{
"source_name": "Bastille April 2017",
"url": "https://www.bastille.net/blogs/2017/4/17/dallas-siren-attack"
},
{
"source_name": "Zack Whittaker April 2017",
"url": "https://www.zdnet.com/article/experts-think-they-know-how-dallas-emergency-sirens-were-hacked/"
}
]
}Explicit source assertions (6)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:M0813 → mitigates → ATTACK:ics:T0848
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f8a6c14-1050-404a-bb6e-4fe107d5b6cd
ATTACK:ics:M0937 → mitigates → ATTACK:ics:T0848
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--575f0e0b-d68d-432b-abb3-cbd3e641fc88
ATTACK:ics:M0930 → mitigates → ATTACK:ics:T0848
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--61668e93-6d9d-418d-9fbd-2d88c3a66544
Karen Scarfone; Paul Hoffman September 2009 · Keith Stouffer May 2015 · Department of Homeland Security September 2016 · Dwight Anderson 2014ATTACK:ics:M0807 → mitigates → ATTACK:ics:T0848
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--652a68a2-a26b-4e8c-86dd-fd83187ed043
Department of Homeland Security September 2016ATTACK:ics:M0802 → mitigates → ATTACK:ics:T0848
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7db9687b-7099-4cb6-a040-bc32fc549a81
ATTACK:ics:C0020 → uses → ATTACK:ics:T0848
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4efcbe0-ffe3-4d9a-8dba-570e68494af1
Marshall Abrams July 2008