T1692.002: Reporting Message
Essential information
- MITRE technique ID
T1692.002- Confidence
- 75/100
- Revoked
- No
- Published
- 20/04/2026 22:54
- Modified
- 04/05/2026 16:52
- Author / Source
- The MITRE Corporation
Description
Adversaries may spoof reporting messages in control system environments for evasion and to impair process control. In control systems, reporting messages contain telemetry data (e.g., I/O values) pertaining to the current state of equipment and the industrial process. Reporting messages are important for monitoring the normal operation of a system or identifying important events such as deviations from expected values.
If an adversary has the ability to Spoof Reporting Messages, they can impact the control system in many ways. The adversary can Spoof Reporting Messages that state that the process is operating normally, as a form of evasion. The adversary could also Spoof Reporting Messages to make the defenders and operators think that other errors are occurring in order to distract them from the actual source of a problem.(Citation: Bonnie Zhu, Anthony Joseph, Shankar Sastry 2011)
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-ics-attack-v19 | evasion |
| mitre-ics-attack | evasion |
| mitre-ics-attack-v19 | impair-process-control |
| mitre-ics-attack | impair-process-control |
Marking (TLP)
Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.