Adversaries may establish command and control capabilities over commonly used application layer protocols such as HTTP(S), OPC, RDP, telnet, DNP3, and modbus. These protocols may be used to disguise adversary actions as benign network traffic. Standard protocols may be seen on their associated port or in some cases over a non-standard port. Adversaries may use these protocols to reach out of the network for command and control, or in some cases to other infected devices within the network.
| ID | Name | Description |
|---|---|---|
| S0089 | BlackEnergy |
BlackEnergy uses HTTP POST request to contact external command and control servers. [1] |
| S1165 | FrostyGoop |
FrostyGoop utilizes the Modbus protocol for transmitting commands to victim devices.[2] |
| S1045 | INCONTROLLER |
INCONTROLLER can remotely send commands to a malicious agent uploaded on Omron PLCs over HTTP or HTTPS.[3] |
| G0049 | OilRig |
OilRig communicated with its command and control using HTTP requests. [4] |
| S0496 | REvil |
REvil sends HTTPS POST messages with randomly generated URLs to communicate with a remote server. [5] [6] |
| S0603 | Stuxnet |
Stuxnet uses a thread to monitor a data block DB890 of sequence A or B. This thread is constantly running and probing this block (every 5 minutes). On an infected PLC, if block DB890 is found and contains a special magic value (used by Stuxnet to identify his own block DB890), this blocks data can be read and written. This thread is likely used to optimize the way sequences A and B work, and modify their behavior when the Step7 editor is opened. [7] |
| S1009 | Triton |
Triton can communicate with the implant utilizing the TriStation 'get main processor diagnostic data' command and looks for a specifically crafted packet body from which it extracts a command value and its arguments. [8] |
| ID | Mitigation | Description |
|---|---|---|
| M0807 | Network Allowlists |
Network allowlists can be implemented through either host-based files or system host files to specify what external connections (e.g., IP address, MAC address, port, protocol) can be made from a device. Allowlist techniques that operate at the application layer (e.g., DNP3, Modbus, HTTP) are addressed in the Filter Network Traffic mitigation. |
| M0931 | Network Intrusion Prevention |
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. |
| M0930 | Network Segmentation |
Ensure proper network segmentation between higher level corporate resources and the control process environment. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0799 | Detection of Standard Application Layer Protocol | AN1931 |
Real-time monitoring identifies Domain Name System (DNS) queries from Industrial Control System (ICS) host Internet Protocol (IP) addresses to external resolvers for domains not associated with any approved ICS vendor, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. |
| AN2155 |
Real-time monitoring identifies Industrial Control System (ICS) Linux service processes initiating outbound application-layer protocol connections to ports/destinations outside the approved communication matrix. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. |
||
| AN2223 |
Near-real-time connection monitoring identifies an embedded field device or gateway initiating outbound connections on standard application-layer protocol ports to destinations outside the expected Industrial Control System (ICS) communication baseline. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. This analytic is implementable from session/flow metadata (endpoints, ports, protocol/service, timing, bytes); it does not require or claim packet-payload visibility. |
||
| AN2281 |
Real-time monitoring identifies an Industrial Control System (ICS) Windows host making outbound connections on HTTP/HTTPS/DNS ports to destinations outside the approved Industrial Control System (ICS) communication baseline, from processes that are not recognized Industrial Control System (ICS) vendor applications. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. |