Attack data that ships with the answer key.
MITRE ATT&CK for ICS attack datasets with per-event ground truth, full pcapng capture, and a benign baseline mix you can dial — plus deployable Sigma / YARA / Suricata / Snort rules in the same bundle.
Stand-alone for IDS / SOC training, or chained on top of a Virtual SCADA run for a full cyber-range scenario against a live, physics-honest plant.
Review the plan below and approve to start execution.
- ATT&CK for ICS
- v15
- MITRE techniques
- 32
- Bundle artefacts
- 7 core
- Mix tunable
- 0–100%
- Replay
- byte-equal
Scenario in. Sealed cyber-range bundle out.
The same evidence pipeline as the synthetic-data side, with one extra step: an attack mix injected on a deterministic schedule against a live SCADA process, and a truth file that names every adversary action by its MITRE ID. What the SOC team walks away with is a reusable cyber-range — replay it against your IDS, score per-event precision and recall, run it again next quarter to measure detection regression. The seed is stable, so the run is stable.
Pick the scenario.
Describe a plant (any process you can name), pick the MITRE ATT&CK for ICS classes you want injected, and dial the benign-to-attack ratio. Or upload a custom adversary YAML.
Seal the job spec.
Scenario, seed, and adversary schedule are sealed into a signed job spec. Replays are byte-equal — across clusters, across years.
SCADA + injection.
The Virtual SCADA layer drives the legitimate process — real controllers, real setpoints, real ISA-18.2 alarm bands. On that baseline the ICS engine injects ATT&CK for ICS techniques on the sealed schedule. Each technique runs against the live plant model, so an alarm-suppression event actually silences a real alarm and a setpoint-modify actually perturbs the loop — your IDS scores against a labelled consequence, not just a labelled packet.
Seven cyber-range artefacts, one sealed bundle.
pcapng, signals.parquet, truth.ndjson, alarms.json, commands.json, asset_inventory.json, and the inner multi-part evidence bundle — all hashed and chained into a tamper-evident .tar.zst. Verifiable offline with rady evidence verify.
Compose a scenario in plain English — approve the plan — run.
ICS Security mode resolves your description to a plant, protocol surface, and run window, then the Agentic Data Scientist lays out a reviewable plan you approve before a single credit is spent.
- The composer resolves protocols, duration and poll rate — and the plant — from one sentence, with a live credit estimate.
- The plan is explicit: generate the plant data, simulate the ICS attacks, verify quality — nothing runs until you approve.
- Every technique you schedule must exist in the engine's registry — an unsupported technique ID is rejected, so what you see is what actually ran.
Got it. A few quick choices before I launch the simulation:
Every bundle ships deployable detection rules — for the SOC stack you already run.
The ground truth isn't just labels in a file. Each ICS bundle carries ready-to-deploy detection content in four industry-standard formats, generated from the same attack signatures the engine emits — so the bundle is self-detecting, and the per-category counts are computed from the real tar.gz contents, never hardcoded.
Every ICS attack bundle ships ready-to-deploy detection rules across 4 industry-standard formats. Import the format that matches your SOC stack — the rules trigger on the same attack signatures the engine emits, so the bundle is self-detecting.
Generic SIEM-agnostic detection rules. One file per canonical attack-event archetype (e.g. modbus_read, alarm_acknowledgement, remote_access_session). Translates to Splunk / Elastic / Sentinel / Graylog via `sigmac --target <backend>`.
$ sigmac --target splunk sigma/*.yml > radmah-ics.splunk.confFile / binary signature rules. Same archetypes as Sigma; useful for forensic scans of captured pcaps / dropped tooling. Compiles with `yarac` for production deployment.
$ yarac yara/*.yar radmah-ics.yarcSingle multi-rule file for the Suricata IDS engine. Carries every protocol-level signature the generator emits with modbus.access constraints where applicable.
$ cp suricata/radmah-ics.rules /etc/suricata/rules/ && suricatactl reloadSingle multi-rule file for the Snort IDS engine. Same protocol signatures as the Suricata file in Snort's rule syntax.
$ cp snort/radmah-ics.rules /etc/snort/rules/ && systemctl reload snortPer-category counts are computed at render time from the bundle’s actual detection_rules.tar.gzcontents — no hardcoded values, no drift with future generator revisions. The README inside the tar.gz documents the full archetype list + per-rule rationale.
Sigma
SIEM-agnostic rules — one per attack-event archetype; translates to Splunk / Elastic / Sentinel / Graylog.
YARA
File / binary signature rules for forensic scans of captured pcaps or dropped tooling.
Suricata
A multi-rule file carrying every protocol-level signature the generator emits.
Snort
The same protocol signatures in Snort rule syntax, ready to reload.
32 engine-implemented techniques. Per-event truth.
Every injected event carries its MITRE technique ID, payload hash, target asset, and entry/exit timestamps in the truth file — your detection engine has nothing to guess. The catalogue below is a representative slice of the engine's technique set, spanning every ATT&CK for ICS tactic from Initial Access through Impact.
| Name | Attck Version | Evaluation Status | Fidelity | Contract Source Hash |
|---|---|---|---|---|
| Automated Collection | v14.1 | per_run_evaluated | signature_only | ec1749988fa12bb752b5878… |
| Block Command Message | v14.1 | per_run_evaluated | signature_only | ec1749988fa12bb752b5878… |
| Block Reporting Message | v14.1 | per_run_evaluated | signature_only | ec1749988fa12bb752b5878… |
| Command-Line Interface | v14.1 | per_run_evaluated | signature_only | ec1749988fa12bb752b5878… |
| Data Destruction | v14.1 | per_run_evaluated | signature_only | ec1749988fa12bb752b5878… |
| Denial of Service | v14.1 | per_run_evaluated | signature_only | ec1749988fa12bb752b5878… |
| Manipulation of Control | v14.1 | per_run_evaluated | signature_only | ec1749988fa12bb752b5878… |
| Modify Alarm Settings | v14.1 | per_run_evaluated | signature_only | ec1749988fa12bb752b5878… |
Full wire capture, link-layer accurate.
Per-event ground-truth labels for every injected adversary action.
Per-tag time-series during the attack window.
Operator-visible alarms and acknowledgements.
Engineering-station command stream + identity tags.
Devices, firmware, and roles in the scenario.
Hash-chained, signed manifest. Verifiable offline.
Command-Line Interface
Adversary-driven command-injection scenarios on industrial control surfaces.
Denial of Service
Realistic resource-exhaustion behaviours targeting control-loop responsiveness.
Adversary-in-the-Middle
Realistic AiTM scenarios between engineering and operator stations.
Manipulation of Control
Direct control-logic manipulation surfaced with before/after register state.
Manipulation of View
Operator-visible value spoofing with ground-truth underlying state.
Modify Parameter
Setpoint, alarm-threshold, and trip-curve modification with labelled diffs.
Modify Alarm Settings
Alarm-limit tampering events tagged with ISA-18.2 band deltas.
Network Sniffing
Passive reconnaissance scenarios with realistic protocol fingerprints.
Program Download
Program-download sequences with vendor-protocol framing.
Unauthorized Command Message
Unsanctioned control writes surfaced with labelled provenance.
Spoof Reporting Message
Historian-reporting spoofing scenarios with labelled deltas to ground truth.
Change Operating Mode
Run / Program / Remote-mode transitions with telemetry capture.
Valid Accounts
Credentialed access scenarios with identity-chain capture in commands.json.
Exploitation of Remote Services
Vendor-protocol exploitation scenarios with reproducible payload signatures.
Standard Application Protocol
Protocol-encapsulation abuse across common industrial transports.
Indicator Removal on Host
Log-tampering and history-wipe scenarios with forensic-detectable residue.
Alarm Suppression
Targeted suppression of process and equipment alarms.
Service Stop
Targeted control-service termination with restart-fingerprint capture.
Internet Accessible Device
Reachability scenarios for incorrectly-exposed devices.
Modify Program
Program-modification scenarios with before/after program signatures.
Every tactic in ATT&CK for ICS v15. End-to-end kill chain, sealed.
Detection engineers score on whether the kill chain they care about has realistic, replayable data at every step. We cover all twelve ATT&CK for ICS v15 tactics, from Initial Access through Impact, with per-event truth labels — the truth file names each event by tactic and technique ID, so your coverage matrix is populated mechanically from the bundle. No hand-mapping, no drift.
Initial Access
External remote services, engineering workstation compromise, replication through removable media, supply-chain compromise of a control-network device.
Execution
Native API abuse, command-line interface, scripting, user execution of a weaponised project file — all with identity-chain capture in commands.json.
Persistence
Modify program, modify controller tasking, hard-coded credential abuse — surfaced with before / after program signatures and hash-chained audit.
Privilege Escalation
Exploitation for privilege escalation and hooking — with ground-truth capture of the resulting control-context elevation.
Evasion
Indicator removal on host, change operating mode, spoof reporting message, alarm suppression, masquerading of operator-visible state.
Discovery
Network connection enumeration, I/O image, remote-system information discovery — with realistic vendor-protocol fingerprints on the wire.
Lateral Movement
Default credentials, exploitation of remote services, hardcoded service accounts, program-download sequences across controllers.
Collection
Automated collection, data from information repositories, monitor process state, adversary-in-the-middle capture of control traffic.
Command and Control
Connection proxy, commonly-used port abuse, standard application protocol over industrial transports.
Inhibit Response
Block command message, block reporting message, service stop, system firmware attack, denial of service targeting control responsiveness.
Impair Process
Brute-force I/O, modify parameter, modify alarm settings, unauthorized command message — landed against a live physics model so there is a labelled consequence, not just a labelled packet.
Impact
Damage to property, denial of control, denial of view, loss of availability / control / productivity, manipulation of control, manipulation of view, theft of operational information.
Standards-anchored. Chain-verifiable. Live + sealed.
Every injected event lands with a MITRE ATT&CK for ICS v15 technique ID, a STIX-2.1 shaped attack graph, CWE and CAPEC cross-references, and an ISA-18.2 alarm-engine response from the plant. Attack events stream over SSE in the same window as they land in the sealed bundle — with a Merkle-chained operator journal that makes tampering deterministic to detect.
MITRE ATT&CK for ICS v15
First-class technique IDs, tactic chains, CWE references, and CAPEC cross-links travel with every injected event. Attack graphs are STIX 2.1 shaped; downstream detection stacks consume them natively.
ISA-18.2 alarm engine
Every plant run ships with an ISA-18.2 / IEC 62682 / EEMUA-191 compliant alarm state machine. Thresholds placed via mutual-information optimum or percentile fallback, class-default bands backstop every signal, hash-chained operator journal.
Live attack window + batch
Stream attack events as they fire via Server-Sent Events on the same endpoint as benign telemetry. The batch bundle receives the same attack-window slice with full pcapng segmentation and manifest index.
Hash-chained attack journal
Every injected event is Merkle-chained into the evidence bundle. Re-ordering, insertion, or silent deletion breaks the chain; the offline verifier flags any tampering deterministically.
Who runs it.
SOC engineering
Train and regression-test detection rules against labelled attack mixes; the bundle even ships the Sigma / YARA / Suricata / Snort rules, so it integrates into your CI scoring pipeline.
IDS / NDR vendors
Train, evaluate, and publish reproducible benchmarks against MITRE ATT&CK for ICS coverage claims.
Critical-infra operators
Tabletop exercises with realistic process state — every event has a ground-truth label so blue-team scoring is mechanical.
Regulator and assessor
Reproducible scenarios you can hand to a third-party assessor without revealing your real plant.
Posture & isolation.
Built so an OT security review can sign off on the first read.
Tenant isolation
Per-tenant Fernet key on artefact prefix; per-tenant evidence chain root.
Tamper-evident bundles
The offline verifier flags any in-place mutation of pcapng, truth log, or parquet.
Audit-ready provenance
SBOM + engine version + scenario hash + run-log shipped with every bundle.
Composable with VPLC
The attack mix can target a customer-owned Virtual PLC for fully air-gapped runs.
Sample bundle on request — under NDA, in your bucket.
Tell us the protocol surface and ATT&CK classes you want covered. We cut a representative bundle, deliver it to a bucket of your choice, and walk your detection engineer through the truth file and the detection rules.