Enhancing Situational Awareness in Smart Grids through Event Correlation for ATT&CK Mapping

The increasing complexity and connectivity of Smart Grids (SGs) have made them vulnerable to cyber-physical threats, highlighting the need for improved situational awareness in the energy domain. To meet this need, we present ECAM (Event Correlation for ATT&CK Mapping), an approach that uses the Industrial Control Systems (ICS)-specific MITRE ATT&CK framework to support the correlation and interpretation of security events. We outline a workflow for implementing and testing ECAM, aimed at strengthening the security of future power grids. The approach successfully maps the conducted attacks to techniques T0814 (Denial of Service) and T0830 (Adversary-in-the-Middle), demonstrating its effectiveness in improving situational awareness. Therefore, we propose the ECAM approach along with a workflow to guide future research and advancements.