Standard Application Layer Protocol
Technique · ATTACK:ics:T0869
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T0869",
"title": "Standard Application Layer Protocol",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T0869",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387",
"external_id": "T0869",
"domain": "ics",
"created": "2020-05-21T17:43:26.506Z",
"modified": "2026-10-13T17:48:53.199Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"command-and-control"
],
"source_references": [
]
}Explicit source assertions (12)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:S1045 → uses → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d4f2f88-e176-42c7-8258-52b345045662
CISA-AA22-103AATTACK:ics:M0930 → mitigates → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ff88ef7-44fd-4307-b381-2e0bc76ce83b
ATTACK:ics:S0089 → uses → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a7d1db3-9383-4171-8938-382e9b0375c6
Booz Allen HamiltonATTACK:ics:M0931 → mitigates → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5be1f2b1-75fd-4e7e-901b-495cee4ab5ad
ATTACK:ics:S1165 → uses → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5c8c8976-2cac-4185-9719-ef55c1032d6a
Dragos FROSTYGOOP 2024ATTACK:ics:T0869.001 → subtechnique-of → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--81722115-69d3-4769-89e5-53491504d9c4
ATTACK:ics:T0869.002 → subtechnique-of → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3f29beb-4a3d-48c6-93ac-136646236a1a
ATTACK:ics:S0603 → uses → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc383819-2e40-49b4-bea9-95eb5d418877
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011ATTACK:ics:S0496 → uses → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c90cfddb-253b-41c8-9057-2abde6f8aa6d
SecureWorks September 2019 · Tom Fakterman August 2019ATTACK:ics:G0049 → uses → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d2dc57eb-5be2-4f9c-a4f7-18d2085ff412
Robert Falcone, Bryan Lee May 2016ATTACK:ics:M0807 → mitigates → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d854cc38-adf7-485d-96b5-70606f6cb87e
ATTACK:ics:S1009 → uses → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f584a257-c22a-434b-aa2d-6220987821ab
Jos Wetzels January 2018