Attack data that ships with the answer key.
MITRE ATT&CK ICS attack datasets with per-event ground truth, full pcapng capture, and a benign baseline mix you can dial. Stand-alone for IDS / SOC training, or chained on top of a Virtual SCADA run for full cyber-range scenarios.
- ATT&CK for ICS
- v15
- MITRE techniques
- 67
- Bundle artefacts (7 outer + 9 inner)
- 16
- Mix tunable
- 0–100%
- Replay
- byte-equal
Scenario in. Sealed cyber-range bundle out.
Same evidence pipeline as the synthetic-data side, with one extra step: an attack mix injected on a deterministic schedule against a live SCADA process, and a truth file that names every adversary action by MITRE ID.
What the SOC team walks away with is a reusable cyber-range — a sealed.tar.zstthat carries the packet capture (pcapng), the per-signal time series (signals.parquet), the alarm log, the command log, the asset inventory, and the ground-truth label file (truth.ndjson). Replay it against your IDS under evaluation; score per-event precision and recall; run the same scenario again next quarter to measure your detection regression. The seed is stable, so the run is stable.
Pick the scenario.
Choose a plant template (water, power, manufacturing…), pick the MITRE ATT&CK ICS classes you want injected, and dial the benign-to-attack ratio. Or upload a custom adversary YAML.
Seal the job spec.
Scenario, seed, and adversary schedule are sealed into a signed job spec. Replays are byte-equal — across clusters, across years.
SCADA + injection.
The Virtual SCADA layer drives the legitimate process — real controllers, real setpoints, real alarm bands from the ISA-18.2 engine. On top of that baseline, the ICS engine injects ATT&CK ICS techniques on the schedule sealed into the job. Packets leave the wire exactly as a real control network would see them: Modbus/TCP function codes, OPC-UA session frames, DNP3 control relay blocks, IEC 61850 MMS writes — all captured link-layer accurate into the pcapng artefact.
Injection isn't a packet-replay trick. Each technique runs against the live plant model, so an alarm-suppression event actually silences a real ISA-18.2 alarm that the process would otherwise raise; a setpoint modify actually perturbs the control loop, and the physics engine reacts. That is what lets your IDS score the detection against a labelled consequence, not just a labelled packet.
Seven cyber-range artefacts wrap one multi-part evidence cryptographic hash seal.
pcapng, signals.parquet, truth.ndjson, alarms.json, commands.json, asset_inventory.json, and the inner multi-part evidence cryptographic hash evidence bundle (contract, determinism, constraint, utility, privacy, run telemetry, evidence record, artefact index, evidence seal) — all hashed and chained into a tamper-evident.tar.zst bundle.
rady evidence verify67 MITRE ATT&CK ICS techniques. Per-event truth.
Every injected event carries its MITRE technique ID, payload hash, target asset, and entry/exit timestamps in the truth file. Your detection engine has nothing to guess. The 20 showcased below are a representative slice of the full 67-technique catalog (the public ATT&CK ICS technique set) spanning every ATT&CK for ICS tactic from Initial Access through Impact.
Command-Line Interface
Adversary-driven command-injection scenarios on industrial control surfaces.
Denial of Service
Realistic resource-exhaustion behaviours targeting control-loop responsiveness.
Adversary-in-the-Middle
Realistic AiTM scenarios between engineering and operator stations.
Manipulation of Control
Direct control-logic manipulation surfaced with before/after register state.
Manipulation of View
Operator-visible value spoofing with ground-truth underlying state.
Modify Parameter
Setpoint, alarm-threshold, and trip-curve modification with labelled diffs.
Modify Alarm Settings
Alarm-limit tampering events tagged with ISA-18.2 band deltas.
Network Sniffing
Passive reconnaissance scenarios with realistic protocol fingerprints.
Program Download
Program-download sequences with vendor-protocol framing.
Unauthorized Command Message
Unsanctioned control writes surfaced with labelled provenance.
Spoof Reporting Message
Historian-reporting spoofing scenarios with labelled deltas to ground truth.
Change Operating Mode
Run / Program / Remote-mode transitions with telemetry capture.
Valid Accounts
Credentialed access scenarios with identity-chain capture in commands.json.
Exploitation of Remote Services
Vendor-protocol exploitation scenarios with reproducible payload signatures.
Standard Application Protocol
Protocol-encapsulation abuse across common industrial transports.
Indicator Removal on Host
Log-tampering and history-wipe scenarios with forensic-detectable residue.
Alarm Suppression
Targeted suppression of process and equipment alarms.
Service Stop
Targeted control-service termination with restart-fingerprint capture.
Internet Accessible Device
Reachability scenarios for incorrectly-exposed devices.
Modify Program
Program-modification scenarios with before/after program signatures.
- · evidence.bundle.tar.zst47.2 MB
- · manifest.jsonsha a4f2d8
- · sealed contract.jsonsha 9c10ab
- ▾ pcapng/
- · scada-2026-04-13.pcapng42.7 MBsha 5e2c1a
- ▾ signals/
- · process.parquet3.4 MBsha 1b8d44
- ▾ events/
- · truth.ndjson11 KBsha 5e2c1a
- · alarms.json2.1 KBsha 82a09f
- · commands.json8.4 KBsha 31cf7e
- · asset_inventory.json0.9 KBsha 70b1d2
- · sbom.spdx.json14 KBsha ee04c1
- · cryptographic hash.chain0.3 KBsha a4f2d8
Full wire capture, link-layer accurate.
Per-event ground truth labels for every injected adversary action.
Per-tag time-series during the attack window.
Operator-visible alarms and acknowledgements.
Every tactic in ATT&CK for ICS v15. End-to-end kill chain, sealed.
Detection engineers don't score on technique breadth alone — they score on whether the kill chain they care about has realistic, replayable data at every step. We cover all twelve ATT&CK for ICS v15 tactics, from Initial Access through Impact, with per-event truth labels at every stage.
The truth file names each event by its tactic and technique identifier, so your MITRE coverage matrix is populated mechanically from the bundle — no hand-mapping, no guessing, no drift. Every injected action is tied back to a specific CWE and CAPEC entry.
Initial Access
External remote services, engineering workstation compromise, replication through removable media, supply-chain compromise of a control-network device.
Execution
Native API abuse, command-line interface, scripting, user execution of a weaponised project file — all with identity-chain capture in commands.json.
Persistence
Modify program, modify controller tasking, hard-coded credential abuse — surfaced with before / after program signatures and hash-chained audit.
Privilege Escalation
Exploitation for privilege escalation and hooking — with ground-truth capture of the resulting control-context elevation.
Evasion
Indicator removal on host, change operating mode, spoof reporting message, alarm suppression, masquerading of operator-visible state.
Discovery
Network connection enumeration, I/O image, remote-system information discovery — with realistic vendor-protocol fingerprints on the wire.
Lateral Movement
Default credentials, exploitation of remote services, hardcoded service accounts, program-download sequences across controllers.
Collection
Automated collection, data from information repositories, monitor process state, adversary-in-the-middle capture of control traffic.
Command and Control
Connection proxy, commonly-used port abuse, standard application protocol over industrial transports.
Inhibit Response
Block command message, block reporting message, service stop, system firmware attack, denial of service targeting control responsiveness.
Impair Process
Brute-force I/O, modify parameter, modify alarm settings, unauthorized command message — landed against a live physics model so there is a labelled consequence, not just a labelled packet.
Impact
Damage to property, denial of control, denial of view, loss of availability / control / productivity, manipulation of control, manipulation of view, theft of operational information.
Standards-anchored. Chain-verifiable. Live + sealed.
Every injected event lands with a MITRE ATT&CK for ICS v15 technique ID, a STIX-2.1 shaped attack graph, CWE and CAPEC cross-references, and an ISA-18.2 alarm-engine response from the plant. Attack events stream over SSE in the same window as they land in the sealed bundle — with a Merkle-chained operator journal that makes tampering deterministic to detect.
MITRE ATT&CK for ICS v15
First-class technique IDs, tactic chains, CWE references, and CAPEC cross-links travel with every injected event. Attack graphs are STIX 2.1 shaped; downstream detection stacks consume them natively.
ISA-18.2 alarm engine
Every plant run ships with an ISA-18.2 / IEC 62682 / EEMUA-191 compliant alarm state machine. Thresholds placed via mutual-information optimum or percentile fallback, class-default bands backstop every signal, hash-chained operator journal.
Live attack window + batch
Stream attack events as they fire via Server-Sent Events on the same endpoint as benign telemetry. Batch bundle receives the same attack-window slice with full pcapng segmentation and manifest index.
Hash-chained attack journal
Every injected event is Merkle-chained into the evidence bundle. Re-ordering, insertion, or silent deletion breaks the chain; offline verifier flags any tampering deterministically.
Who runs it.
SOC engineering
Train and regression-test detection rules against labelled attack mixes; bundle integrates into your CI scoring pipeline.
IDS / NDR vendors
Train, evaluate, and publish reproducible benchmarks against MITRE ATT&CK ICS coverage claims.
Critical-infra operators
Tabletop exercises with realistic process state — every event has a ground-truth label so blue-team scoring is mechanical.
Regulator and assessor
Reproducible scenarios you can hand to a third-party assessor without revealing your real plant.
Posture & isolation.
Built so an OT security review can sign off on the first read.
Tenant isolation
Per-tenant Fernet key on artefact prefix; per-tenant evidence chain root.
Tamper-evident bundles
Offline verifier flags any in-place mutation of pcapng, truth log, or parquet.
Audit-ready provenance
SBOM + engine version + scenario hash + run-log shipped with every bundle.
Composable with VPLC
Attack mix can target a customer-owned Virtual PLC for fully air-gapped runs.
Sample bundle on request — under NDA, in your bucket.
Tell us the protocol surface and ATT&CK classes you want covered. We cut a representative bundle, deliver it to a bucket of your choice, and walk your detection engineer through the truth file.
- $ rady evidence verify ./scada-2841.bundle.tar.zst
- → unpacking 14 artefacts ………………… ok
- → checking cryptographic hash chain ………………… ok
- → verifying cryptographic signature signature ……… ok
- manifest: sha 9c10ab…
- sealed contract: sha a4f2d8…
- pcapng: sha 5e2c1a… 42.7 MB
- signals.parquet: sha 1b8d44… 3.4 MB
- truth.ndjson: sha 5e2c1a… 6 events
- cryptographic hash.chain: sha a4f2d8… root a4f2…d801
- ✓ chain verified — 9 / multi-part evidence intact
- ✓ signed by acme-soc-prod (cosign · key-id 0x4f1c)
- $ rady evidence get job_e2f91b37 --truth
- 6 attack events · 3 MITRE classes · 70% benign
- earliest 14:30:06 latest 14:35:42 span 5m36s
- ✓ ready for IDS scoring