Skip to content

Point & Tag Identification

Technique · ATTACK:ics:T0861

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:ics:T0861",
  "title": "Point & Tag Identification",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T0861",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1",
  "external_id": "T0861",
  "domain": "ics",
  "created": "2020-05-21T17:43:26.506Z",
  "modified": "2026-10-13T17:48:49.639Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "Dennis L. Sloatman September 2016",
      "url": "https://www.radioworld.com/industry/understanding-plc-programming-methods-and-the-tag-database-system"
    }
  ]
}

Explicit source assertions (10)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:ics:S1045 → uses → ATTACK:ics:T0861

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--064dfd6f-db5d-48e8-b350-9dd47a270911

ATTACK:ics:M0800 → mitigates → ATTACK:ics:T0861

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--243ad7b2-546c-4bf2-a3c0-1438b13e197d

ATTACK:ics:M0807 → mitigates → ATTACK:ics:T0861

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ecc567f-3aaa-4bd8-935f-4808d177a552

Department of Homeland Security September 2016

ATTACK:ics:M0937 → mitigates → ATTACK:ics:T0861

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--686cbd74-ef49-4e77-9599-21777d3a4738

ATTACK:ics:M0804 → mitigates → ATTACK:ics:T0861

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--79324bdd-cdab-4d0a-af60-af1047c1d117

ATTACK:ics:S0093 → uses → ATTACK:ics:T0861

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90d9c8e3-0250-4096-8d98-7ca1d324d654

Daavid Hentunen, Antti Tikkanen June 2014 · ICS-CERT August 2018

ATTACK:ics:M0813 → mitigates → ATTACK:ics:T0861

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--984992e3-0407-406a-b8dd-c114d8b2d9a2

ATTACK:ics:M0801 → mitigates → ATTACK:ics:T0861

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7f23af2-e948-4531-af56-1a1b4d03702f

ATTACK:ics:M0930 → mitigates → ATTACK:ics:T0861

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7aac6c9-da16-46e2-8cfa-dca07a0a7562

Karen Scarfone; Paul Hoffman September 2009 · Keith Stouffer May 2015 · Department of Homeland Security September 2016 · Dwight Anderson 2014

ATTACK:ics:M0802 → mitigates → ATTACK:ics:T0861

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dbdd9a97-81df-40b8-b72d-ac67d121b8b3

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.