Protocol-aware attack patterns for Modbus, DNP3, S7Comm, OPC UA Red team tradecraft: macro abuse, payload delivery, C2 over HMI, logic poisoning MITRE ATT&CK for ICS cross-referencing: T0835, T0846, ...