# Evidence-Based Analysis of Cyber Attacks to Security Monitored Distributed Energy Resources
## 2 Methodology
### Attack Graphs  
As already mentioned, a node in an AG represents capabilities that the attacker has attained, or equivalently, the security state of the system. Edges, on the other hand, are labelled by tactic/technique pairs specifying an attack step taken by the attacker as a means for achieving a precise goal, which causes an evolution in the security state of the system (typically a downgrade). We assume in this work that the attacker has already compromised a plant controller in the OT network by means of the external interface. We disregard here the detailed IT oriented phases of the attack (the BN model of the preliminary phases is presented in [36]). The attacker can disturb the physical process by means of a fake operation in the DER control loop. The AG is depicted in Figure 2. The starting node is _\"A controls SCADA\"_ where A is the attacker; the attacker's target is the status _\"Unstable power system\"_ (shaded node in Figure 2). As anticipated, we restrict our proof of concept analysis to a few possible attack paths. We take inspiration from [40]; for the techniques we use to label edges, but specialise and enrich them with the energy control background. We also introduce attack patterns to automatic controls of some subsystem (dotted lines in the AG of Figure 2). The subsystem is either compromised or fed by maliciously crafted data, and its reaction would disrupt operation or damage assets. In order to make the setting more realistic, we assume that some kind of check/protection is in place, forbidding in some cases such disruptive or damaging control (dotted arcs _wrong logic execution_ and _correct reaction to wrong data_). The attacker can modify the control logic of the field devices from the SCADA server, thereby getting the devices to react in unexpected ways to the commands received. Notice that this is similar to the final technique used by Stuxnet, which modified the Siemens S7 PLC software. An alternative way to obtain the same goal is a man-in-the-middle (MITM) attack on the compromised node, intercepting data to and from the SCADA server; i.e., the plant controller. The technique _Local_ MITM assumes that the attacker installs MITM malware directly on the SCADA system. A MITM technique is listed in the ICS ATT&CK matrix but that technique assumes that the attacker has not gained control of the SCADA system and either uses the address resolution protocol (ARP) spoofing or a proxy to achieve her goal. The reason for using here a more specific version of this technique is to enable a precise set of analytics to expose the attack (see Section 2.3). Being able to manage the control communications, the attacker can alter or spoof reporting messages containing the electrical measures from the field that the SCADA software in the plant controller will consider genuine and react to, causing malfunctioning. Alternatively, the MITM malware can modify outgoing command messages (technique _impact/manipulation of control_) from the SCADA system to the controlled nodes (i.e., the DER). The technique--modify reporting message--is not among those analysed in the ICS ATT&CK matrix, but is one of our energy-specific extensions. A third attack path is the installation of a new ICS service on the SCADA victim (_persistence/new ICS service_) that pretends to be the genuine service (_IPC/masquerading_). The malicious service is protocol-specific (e.g., IEC 61850, IEC 60870-5-104, Modbus, etc.) and will send malicious commands to disrupt services or destruct assets (_IPC/spoof command message_). This path is inspired by the Ukraine attacks on the power grid on December 17, 2016 where CrashOverride/industroyer malware affected the Kiev power grid area. Notice that the technique _new ICS service_ does not appear in the ICS ATT&CK matrix and is a specialisation to the power domain of the analogous one from the IT ATT&CK matrix.