Real-time monitoring identifies Industrial Control System (ICS) protocol commands succeeding against protected device functions from a source or session context that the device's documented access control model should reject, indicating exploitation of a vulnerability to bypass the device's privilege model. Documented as the core mechanism of the Triton attack, which exploited a zero-day in Triconex firmware while in PROGRAM mode. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | NSM:Connections | device process crash or unexpected restart immediately followed by privileged protocol command succeeding from same source session |
| Application Log Content (DC0038) | device:VendorLog | protected function (firmware write, memory protection mode change) succeeds for a session that did not complete the documented authentication/privilege-elevation sequence |
| Field | Description |
|---|---|
| ExploitCrashCorrelationWindow | Time window within which a device/process crash and subsequent privileged action are considered correlated. |
| KnownVulnerableDriverSignatures | Documented hash/name signatures of known vulnerable drivers exploitable for privilege escalation (BYOVD technique). |
Real-time monitoring identifies a process owned by an Industrial Control System (ICS) service User Identifier (UID) executing a Set User Identifier (SUID) binary or exploiting a kernel vulnerability to obtain root privileges, detected via unexpected setuid/setgid syscalls from a process not invoked via sudo. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Process Metadata (DC0034) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): setuid/setgid to root from a process owned by Industrial Control Systems (ICS) service User Identifier (UID) that was not invoked via sudo |
| Field | Description |
|---|---|
| ExploitCrashCorrelationWindow | Time window within which a device/process crash and subsequent privileged action are considered correlated. |
| KnownVulnerableDriverSignatures | Documented hash/name signatures of known vulnerable drivers exploitable for privilege escalation (BYOVD technique). |
Real-time monitoring identifies network device management commands succeeding from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, following exploit-pattern traffic to the device's management interface, suggesting exploitation of a management-plane vulnerability to gain elevated access without valid credentials. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | management command succeeds from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, preceded by exploit-pattern traffic to management interface |
| Field | Description |
|---|---|
| ExploitCrashCorrelationWindow | Time window within which a device/process crash and subsequent privileged action are considered correlated. |
| KnownVulnerableDriverSignatures | Documented hash/name signatures of known vulnerable drivers exploitable for privilege escalation (BYOVD technique). |
Real-time monitoring identifies an Industrial Control System (ICS) operator/service account being granted elevated Windows privileges without a corresponding administrative logon event, or a process crash in an Industrial Control System (ICS) vendor application immediately followed by a new process inheriting elevated token privileges. Documented in PIPEDREAM's LAZYCARGO component, which drops and exploits a known vulnerable ASRock driver to elevate credentials. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Metadata (DC0088) | WinEventLog:Security | Windows Security Event ID 4624/4625: EventCode=4672 for Industrial Control Systems (ICS)-role account without corresponding admin-group logon in preceding session |
| Driver Load (DC0079) | WinEventLog:Sysmon | EventCode=6 of a known vulnerable third-party driver immediately preceding privilege escalation indicators |
| Field | Description |
|---|---|
| ExploitCrashCorrelationWindow | Time window within which a device/process crash and subsequent privileged action are considered correlated. |
| KnownVulnerableDriverSignatures | Documented hash/name signatures of known vulnerable drivers exploitable for privilege escalation (BYOVD technique). |