{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0820","id":"T0820","name":"Exploitation for Evasion","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0820","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"1e9108f8dfd6e4fa9037d86c93842ed848c723677b3985679ab8bfa43ce2303b","description":"Adversaries may exploit a software vulnerability to take advantage of a programming error in a program, service, or within the operating system software or kernel itself to evade detection. Vulnerabilities may exist in software that can be used to disable or circumvent security features.  \n\nAdversaries may have prior knowledge through [Remote System Information Discovery](https://attack.mitre.org/techniques/T0888) about security features implemented on control devices. These device security features will likely be targeted directly for exploitation. There are examples of firmware RAM/ROM consistency checks on control devices being targeted by adversaries to enable the installation of malicious [System Firmware](https://attack.mitre.org/techniques/T0857).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0820","external_id":"T0820"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"ics/T0820","id":"T0820","name":"Exploitation for Evasion","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0820","technique_page":"techniques/ics/T0820/","page":"detections/ics/T0820/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0795","name":"Detection of Exploitation for Evasion","url":"https://attack.mitre.org/detectionstrategies/DET0795","stix_id":"x-mitre-detection-strategy--97914ffd-b189-415e-9309-e63e3be01b1e","relationship_id":"relationship--c95ce502-b63d-42c6-a9f2-5a3cb0922e27","description":"","analytics":[{"id":"AN1927","name":"Analytic 1927","guidance":"Real-time monitoring identifies malformed or out-of-spec ICS protocol exchanges targeting an embedded device from a source outside the approved communication baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0795#AN1927","platforms":["Embedded"],"tuning":[{"field":"ExploitCrashCorrelationWindow","description":"Time window correlating a memory access event with a subsequent crash."},{"field":"TrustedSecurityToolList","description":"Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"anomalous protocol exchange preceding device behavioral change (reboot, altered configuration)","platforms":["Embedded"],"analytic_id":"AN1927","source_url":"https://attack.mitre.org/detectionstrategies/DET0795#AN1927","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN2154","name":"Analytic 2154","guidance":"Real-time monitoring identifies ptrace syscalls or /proc/pid/mem write operations targeting Industrial Control System (ICS) service processes from a process that is not a debugger or vendor diagnostic tool. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0795#AN2154","platforms":["Linux"],"tuning":[{"field":"ExploitCrashCorrelationWindow","description":"Time window correlating a memory access event with a subsequent crash."},{"field":"TrustedSecurityToolList","description":"Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access."}],"log_sources":[]},{"id":"AN2199","name":"Analytic 2199","guidance":"Real-time monitoring identifies Industrial Control System (ICS) network device syslog recording unexpected restarts or crashes coinciding with anomalous traffic patterns on management interfaces. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0795#AN2199","platforms":["Network Devices"],"tuning":[{"field":"ExploitCrashCorrelationWindow","description":"Time window correlating a memory access event with a subsequent crash."},{"field":"TrustedSecurityToolList","description":"Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"networkdevice:syslog","channel":"unexpected restart or crash coinciding with anomalous traffic pattern on management interface","platforms":["Network Devices"],"analytic_id":"AN2199","source_url":"https://attack.mitre.org/detectionstrategies/DET0795#AN2199","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN2279","name":"Analytic 2279","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) vendor process crashing unexpectedly, immediately preceded by an unusual cross-process memory access event from a process outside the recognized security/diagnostic tool allowlist. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0795#AN2279","platforms":["Windows"],"tuning":[{"field":"ExploitCrashCorrelationWindow","description":"Time window correlating a memory access event with a subsequent crash."},{"field":"TrustedSecurityToolList","description":"Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access."}],"log_sources":[]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1009","name":"Triton","url":"https://attack.mitre.org/software/S1009","kind":"malware","description":"[Triton](https://attack.mitre.org/software/S1009) disables a firmware RAM/ROM consistency check after injects a payload (imain.bin) into the firmware memory region. (Citation: DHS CISA February 2019) (Citation: ICS-CERT December 2018) (Citation: Schneider Electric January 2018) Triconex systems include continuous means of detection including checksums for firmware and program integrity, memory and memory reference integrity, and configuration. (Citation: The Office of Nuclear Reactor Regulation)","relationship_id":"relationship--ea50253a-3220-458b-b810-ad032f2b182f","references":[{"source_name":"DHS CISA February 2019","description":"DHS CISA 2019, February 27 MAR-17-352-01 HatManSafety System Targeted Malware (Update B) Retrieved. 2019/03/08 ","url":"https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf"},{"source_name":"ICS-CERT December 2018","description":"ICS-CERT 2018, December 18 Advisory (ICSA-18-107-02) - Schneider Electric Triconex Tricon (Update B) Retrieved. 2019/03/08 ","url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-107-02"},{"source_name":"Schneider Electric January 2018","description":"Schneider Electric 2018, January 23 TRITON - Schneider Electric Analysis and Disclosure Retrieved. 2019/03/14 ","url":"https://www.youtube.com/watch?v=f09E75bWvkk&index=3&list=PL8OWO1qWXF4qYG19p7An4Vw3N2YZ86aRS&t=0s"},{"source_name":"The Office of Nuclear Reactor Regulation","description":"The Office of Nuclear Reactor Regulation Schneider Electric 2018, January 23 TRITON - Schneider Electric Analysis and Disclosure Retrieved. 2019/03/14  Triconex Topical Report 7286-545-1 Retrieved. 2018/05/30 ","url":"https://www.nrc.gov/docs/ML1209/ML120900890.pdf"}]}],"actors":[],"mitigations":[{"id":"M0919","name":"Threat Intelligence Program","url":"https://attack.mitre.org/mitigations/M0919","kind":"course-of-action","description":"Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.\n","relationship_id":"relationship--08302021-aacf-428f-a0ce-e1034d925fb0","references":[]},{"id":"M0948","name":"Application Isolation and Sandboxing","url":"https://attack.mitre.org/mitigations/M0948","kind":"course-of-action","description":"Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in these systems may still exist. (Citation: Dan Goodin March 2017)\n","relationship_id":"relationship--7ff12adb-bc9a-42e5-9cbf-613b200c36dc","references":[{"source_name":"Dan Goodin March 2017","description":"Dan Goodin 2017, March Virtual machine escape fetches $105,000 at Pwn2Own hacking contest Retrieved. 2020/09/25 ","url":"https://arstechnica.com/information-technology/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/"}]},{"id":"M0950","name":"Exploit Protection","url":"https://attack.mitre.org/mitigations/M0950","kind":"course-of-action","description":"Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: Microsoft Security Response Center August 2017) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia) Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted.\n","relationship_id":"relationship--238f967a-0c29-4aa3-bbb5-3dc593473bbf","references":[{"source_name":"Microsoft Security Response Center August 2017","description":"Microsoft Security Response Center 2017, August Moving Beyond EMET II  Windows Defender Exploit Guard Retrieved. 2020/09/25 ","url":"https://msrc-blog.microsoft.com/2017/08/09/moving-beyond-emet-ii-windows-defender-exploit-guard/"},{"source_name":"Wikipedia","description":"Wikipedia Microsoft Security Response Center 2017, August Moving Beyond EMET II  Windows Defender Exploit Guard Retrieved. 2020/09/25  Control-flow integrity Retrieved. 2020/09/25 ","url":"https://en.wikipedia.org/wiki/Control-flow_integrity"}]},{"id":"M0951","name":"Update Software","url":"https://attack.mitre.org/mitigations/M0951","kind":"course-of-action","description":"Update software regularly by employing patch management for internal enterprise endpoints and servers.\n","relationship_id":"relationship--97c5b388-518a-46ec-b2b0-41bfa6a83204","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0888":"/ttp-simulation/techniques/ics/T0888/","T0820":"/ttp-simulation/techniques/ics/T0820/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0820","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}}]}}