{"description": "ICS techniques used by IOControl, ATT&CK software S9046 (v1.0)", "name": "IOControl (S9046)", "domain": "ics-attack", "versions": {"layer": "4.5", "attack": "20", "navigator": "5.3.2"}, "techniques": [{"techniqueID": "T1701", "showSubtechniques": true}, {"techniqueID": "T1701.003", "comment": "IOCONTROL has executed arbitrary commands using system calls as well as scripts with the UNIX Shell.(Citation: Claroty-IOCONTROL)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T0846", "showSubtechniques": true}, {"techniqueID": "T0846.001", "comment": "IOCONTROL has conducted port scans on a network.(Citation: Claroty-IOCONTROL)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T0869", "showSubtechniques": true}, {"techniqueID": "T0869.001", "comment": "IOCONTROL has used DNS over HTTPS (DoH) via CloudFlare\u2019s API to translate hostnames to IP addresses.(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL)\n\n\n", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T0869.002", "comment": "IOCONTROL connects to C2 servers using the MQTT protocol over port 1883 and 8883 (encrypted via SSL/TLS). The command-and-control servers are resolved using DNS-over-HTTPS (DoH).(Citation: Claroty-IOCONTROL)(Citation: Dragos 2025 Year in Review)(Citation: Armis-IOCONTROL)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by IOControl", "color": "#66b1ff"}]}