{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0819","id":"T0819","name":"Exploit Public-Facing Application","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0819","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"d66b21404dd58b6b8d186412ee9048ed51d26f9ed0796cba54b17b10ce4fe205","description":"Adversaries may leverage weaknesses to exploit internet-facing software for initial access into an industrial network. Internet-facing software may be user applications, underlying networking implementations, an assets operating system, weak defenses, etc. Targets of this technique may be intentionally exposed for the purpose of remote management and visibility.\n\nAn adversary may seek to target public-facing applications as they may provide direct access into an ICS environment or the ability to move into the ICS network. Publicly exposed applications may be found through online tools that scan the internet for open ports and services. Version numbers for the exposed application may provide adversaries an ability to target specific known vulnerabilities. Exposed control protocol or remote access ports found in Commonly Used Port may be of interest by adversaries.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0819","external_id":"T0819"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"ics/T0819","id":"T0819","name":"Exploit Public-Facing Application","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0819","technique_page":"techniques/ics/T0819/","page":"detections/ics/T0819/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0740","name":"Detection of Exploit Public-Facing Application","url":"https://attack.mitre.org/detectionstrategies/DET0740","stix_id":"x-mitre-detection-strategy--ab3f0926-58e2-485e-987c-66b541d9de97","relationship_id":"relationship--f9e33311-f162-4ebd-b944-8704f6dc0fd4","description":"","analytics":[{"id":"AN1873","name":"Analytic 1873","guidance":"Real-time monitoring identifies an internet-facing Industrial Control System (ICS) application server, web Human-Machine Interface (HMI), historian web interface, vendor remote access portal) process spawning an unexpected child process immediately following an inbound web request containing exploit-pattern content. Documented across multiple incidents involving internet-exposed ICS web interfaces. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Analyst implementation must limit predicates to fields actually retained by the web server/WAF (for example URI/path/query/header/status/source); request-body or payload signatures require WAF/DPI or request-body logging and must not be inferred from a basic access log.","url":"https://attack.mitre.org/detectionstrategies/DET0740#AN1873","platforms":["Windows"],"tuning":[{"field":"ApprovedClientCIDR","description":"IP ranges from which legitimate access to the ICS web interface is expected."},{"field":"ExploitPatternSignatures","description":"Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products."},{"field":"ExploitToShellWindow","description":"Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"webserver:applog","channel":"Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface from unapproved source; request-body claims require WAF/DPI logging","platforms":["Windows"],"analytic_id":"AN1873","source_url":"https://attack.mitre.org/detectionstrategies/DET0740#AN1873","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1 with parent matching web/application server process and image matching shell/script interpreter within exploit-to-shell window of anomalous request","platforms":["Windows"],"analytic_id":"AN1873","source_url":"https://attack.mitre.org/detectionstrategies/DET0740#AN1873","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN2133","name":"Analytic 2133","guidance":"Real-time monitoring identifies web server or Industrial Control System (ICS) application logs showing exploit-pattern requests to Industrial Control System (ICS) vendor web interfaces, followed by the web server daemon User Identifier (UID) spawning unexpected shell processes. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Analyst implementation must limit predicates to fields actually retained by the web server/WAF (for example URI/path/query/header/status/source); request-body or payload signatures require WAF/DPI or request-body logging and must not be inferred from a basic access log.","url":"https://attack.mitre.org/detectionstrategies/DET0740#AN2133","platforms":["Linux"],"tuning":[{"field":"ApprovedClientCIDR","description":"IP ranges from which legitimate access to the ICS web interface is expected."},{"field":"ExploitPatternSignatures","description":"Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products."},{"field":"ExploitToShellWindow","description":"Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): unexpected process creation from web server daemon User Identifier (UID) spawning shell process","platforms":["Linux"],"analytic_id":"AN2133","source_url":"https://attack.mitre.org/detectionstrategies/DET0740#AN2133","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0038","component":"Application Log Content","name":"webserver:applog","channel":"Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface; request-body claims require WAF/DPI logging","platforms":["Linux"],"analytic_id":"AN2133","source_url":"https://attack.mitre.org/detectionstrategies/DET0740#AN2133","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN2173","name":"Analytic 2173","guidance":"Real-time monitoring identifies exploit-pattern HTTP/HTTPS traffic targeting an ICS DMZ application from a source or request pattern outside the approved application baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0740#AN2173","platforms":["Network Devices"],"tuning":[{"field":"ApprovedClientCIDR","description":"IP ranges from which legitimate access to the ICS web interface is expected."},{"field":"ExploitPatternSignatures","description":"Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products."},{"field":"ExploitToShellWindow","description":"Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"netflow:ipfix","channel":"IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): inbound exploit-pattern traffic to Industrial Control Systems (ICS) Demilitarized Zone (DMZ) server followed by outbound connection from same Internet Protocol (IP) address to internal ICS network","platforms":["Network Devices"],"analytic_id":"AN2173","source_url":"https://attack.mitre.org/detectionstrategies/DET0740#AN2173","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2235","name":"Analytic 2235","guidance":"Real-time monitoring identifies Hypertext Transfer Protocol (HTTP) requests to an embedded device's management web interface containing exploit-pattern content (oversized parameters, directory traversal sequences) from a source not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0740#AN2235","platforms":["Embedded"],"tuning":[{"field":"ApprovedClientCIDR","description":"IP ranges from which legitimate access to the ICS web interface is expected."},{"field":"ExploitPatternSignatures","description":"Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products."},{"field":"ExploitToShellWindow","description":"Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"Hypertext Transfer Protocol (HTTP) request to device management web interface with exploit-pattern payload from source not in engineering workstation list","platforms":["Embedded"],"analytic_id":"AN2235","source_url":"https://attack.mitre.org/detectionstrategies/DET0740#AN2235","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) actors exploited vulnerabilities in GE's Cimplicity HMI and Advantech/Broadwin WebAccess HMI software which had been directly exposed to the internet. (Citation: ICS-CERT December 2014) (Citation: ICS CERT September 2018)","relationship_id":"relationship--a846dbe5-9ef3-4fb6-93d5-f764671a75c8","references":[{"source_name":"ICS CERT September 2018","description":"ICS CERT 2018, September 06 Advantech/Broadwin WebAccess RPC Vulnerability (Update B) Retrieved. 2019/12/05 ","url":"https://www.us-cert.gov/ics/advisories/ICSA-11-094-02B"},{"source_name":"ICS-CERT December 2014","description":"ICS-CERT 2014, December 10 ICS Alert (ICS-ALERT-14-281-01E) Ongoing Sophisticated Malware Campaign Compromising ICS (Update E) Retrieved. 2019/10/11 ","url":"https://www.us-cert.gov/ics/alerts/ICS-ALERT-14-281-01B"}]}],"mitigations":[{"id":"M0916","name":"Vulnerability Scanning","url":"https://attack.mitre.org/mitigations/M0916","kind":"course-of-action","description":"Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and public disclosure.\n","relationship_id":"relationship--968830b7-ee80-4a6e-96a4-9fc70470e4a9","references":[]},{"id":"M0926","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M0926","kind":"course-of-action","description":"Use least privilege for service accounts. (Citation: Keith Stouffer May 2015) (Citation: National Institute of Standards and Technology April 2013)\n","relationship_id":"relationship--bc3744d6-9275-4d91-8888-16d5f4d5187b","references":[{"source_name":"Keith Stouffer May 2015","description":"Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"},{"source_name":"National Institute of Standards and Technology April 2013","description":"National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"}]},{"id":"M0930","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M0930","kind":"course-of-action","description":"Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.\n","relationship_id":"relationship--fcb7733f-553d-43de-a8c6-c85a5cd65041","references":[]},{"id":"M0948","name":"Application Isolation and Sandboxing","url":"https://attack.mitre.org/mitigations/M0948","kind":"course-of-action","description":"Application isolation will limit the other processes and system features an exploited target can access. Examples of built in features are software restriction policies, AppLocker for Windows, and SELinux or AppArmor for Linux.\n","relationship_id":"relationship--e767c178-e4b2-490a-b544-bb1b2d6c7de4","references":[]},{"id":"M0950","name":"Exploit Protection","url":"https://attack.mitre.org/mitigations/M0950","kind":"course-of-action","description":"Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application. (Citation: Karen Scarfone; Paul Hoffman September 2009)\n","relationship_id":"relationship--ad7fd147-066e-4ed5-aa9d-7b2f1771150d","references":[{"source_name":"Karen Scarfone; Paul Hoffman September 2009","description":"Karen Scarfone; Paul Hoffman 2009, September Guidelines on Firewalls and Firewall Policy Retrieved. 2020/09/25 ","url":"https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-41r1.pdf"}]},{"id":"M0951","name":"Update Software","url":"https://attack.mitre.org/mitigations/M0951","kind":"course-of-action","description":"Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and public disclosure.\n","relationship_id":"relationship--6f2c2043-6487-467a-bb49-e8cd2509ae9f","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0819":"/ttp-simulation/techniques/ics/T0819/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0819","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}