CYBRARY Unit 3 — Detections as evidence
10 minWhere the scenarios come from
Each plant scenario is modeled on published incident reporting and ATT&CK for ICS, not invented.
By the end you can
- Name the published incidents the range scenarios are modeled on.
- Explain why a technique id matters when writing up a finding.
- Say what the range does not claim about those incidents.
The scenarios and their sources
Each scenario on the plant range is built from documented behavior: MITRE's ATT&CK for ICS techniques, and incidents that were investigated and written up publicly.
| Scenario | Modeled on |
|---|---|
| A setpoint was written by something that is not the HMI | Modeled on FrostyGoop heating outage (2024); PIPEDREAM / INCONTROLLER (2022); Maroochy Shire sewage spills (2000). |
| A machine is bridging the office network and the plant network | Modeled on TRITON / TRISIS (2017); PIPEDREAM / INCONTROLLER (2022). |
| A safety interlock is being held in an overridden state | Modeled on TRITON / TRISIS (2017). |
| Controller firmware is being written while the line is running | Modeled on Stuxnet (2010); PIPEDREAM / INCONTROLLER (2022). |
| A second master is issuing commands on the control network | Modeled on Maroochy Shire sewage spills (2000); Industroyer / CRASHOVERRIDE (2016, repeated as Industroyer2 in 2022); FrostyGoop heating outage (2024). |
| Batch records are leaving the plant overnight | Modeled on Dragonfly / Energetic Bear energy-sector intrusions (2014–2018). |
| Somebody is driving the operator's panel from elsewhere | Modeled on Ukraine electric power attack (2015); Unitronics PLC and HMI intrusions (2023). |
| Legacy pumps are being answered by something that is not the gateway | Modeled on Stuxnet (2010); Maroochy Shire sewage spills (2000); FrostyGoop heating outage (2024). |
What is not claimed
The range is a simulation. It reproduces the shape of a published incident — the order of steps, the artifacts each step leaves, the detections that would fire — so the practice transfers. It does not reproduce anybody's network, and it is not a reconstruction of a specific victim's estate.