{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0859","id":"T0859","name":"Valid Accounts","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0859","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"2a86890885b0cf39c3e9b93056a216d7a37c467baf936b03812fa0543f6c4f05","description":"Adversaries may steal the credentials of a specific user or service account using credential access techniques. In some cases, default credentials for control system devices may be publicly available. Compromised credentials may be used to bypass access controls placed on various resources on hosts and within the network, and may even be used for persistent access to remote systems. Compromised and default credentials may also grant an adversary increased privilege to specific systems and devices or access to restricted areas of the network. Adversaries may choose not to use malware or tools, in conjunction with the legitimate access those credentials provide, to make it harder to detect their presence or to control devices and send legitimate commands in an unintended way. \n\nAdversaries may also create accounts, sometimes using predefined account names and passwords, to provide a means of backup access for persistence. (Citation: Booz Allen Hamilton) \n\nThe overlap of credentials and permissions across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator)  and possibly between the enterprise and operational technology environments. Adversaries may be able to leverage valid credentials from one system to gain access to another system.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0859","external_id":"T0859"},{"source_name":"Booz Allen Hamilton","description":"Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.","url":"https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0088","name":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component","category":"Host state and inventory","description":"Attributes of existing logon sessions and their association with accounts or hosts.","collection_focus":"Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["session_id","account","host","session_type"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0082","name":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component","category":"Endpoint activity","description":"Creation of an endpoint network connection linked to a process.","collection_focus":"Enable scoped Sysmon NetworkConnect (3), disabled by default, or a platform-equivalent process-aware network sensor.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_guid","destination_ip","destination_port","protocol","initiated"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."}],"detection":{"key":"ics/T0859","id":"T0859","name":"Valid Accounts","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0859","technique_page":"techniques/ics/T0859/","page":"detections/ics/T0859/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0724","name":"Detection of Valid Accounts","url":"https://attack.mitre.org/detectionstrategies/DET0724","stix_id":"x-mitre-detection-strategy--ffeac6e1-798f-41b1-8baf-2650d2ebe031","relationship_id":"relationship--2c1510bc-99d2-43d6-a58c-585d2dab485e","description":"","analytics":[{"id":"AN1857","name":"Analytic 1857","guidance":"Real-time monitoring identifies an Industrial Control System (ICS)-role account authenticating via interactive or remote logon from a workstation not in the approved host inventory, or outside the account's established usage pattern, immediately followed within a short window by that session connecting to the field device network or ICS application. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0724#AN1857","platforms":["Windows"],"tuning":[{"field":"ApprovedAdminCIDR","description":"IP ranges from which SSH administrative access to ICS Linux assets is authorized."},{"field":"ApprovedHostList","description":"Inventory of workstations/jump hosts from which ICS-role accounts are authorized to authenticate."},{"field":"ApprovedNMSCIDR","description":"IP ranges from which network device administrative access is authorized."},{"field":"AuthToDeviceWindow","description":"Time window after anomalous logon within which device-subnet connection is considered correlated, typically 5-15 minutes."},{"field":"ICSRoleAccountPatterns","description":"Naming convention or group-membership pattern identifying accounts with engineering, operator, or ICS service roles."},{"field":"OfficeHoursWindow","description":"Defined normal working hours for interactive ICS engineering activity, widened for 24/7 shift-based operations."}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"WinEventLog:Security","channel":"Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from workstation not in approved host list or outside office hours window","platforms":["Windows"],"analytic_id":"AN1857","source_url":"https://attack.mitre.org/detectionstrategies/DET0724#AN1857","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0088","component":"Logon Session Metadata","name":"WinEventLog:Security","channel":"Windows Security Event ID 4624/4625: EventCode=4672 for Industrial Control Systems (ICS)-role account from anomalous session","platforms":["Windows"],"analytic_id":"AN1857","source_url":"https://attack.mitre.org/detectionstrategies/DET0724#AN1857","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"},{"component_id":"DC0002","component":"User Account Authentication","name":"WinEventLog:Security","channel":"Windows Security Event ID 4624/4625: EventCode=4648 for Industrial Control Systems (ICS)-role account from process outside approved ICS vendor process list","platforms":["Windows"],"analytic_id":"AN1857","source_url":"https://attack.mitre.org/detectionstrategies/DET0724#AN1857","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0082","component":"Network Connection Creation","name":"WinEventLog:Sysmon","channel":"EventCode=3 to device subnet within auth-to-device window of the anomalous logon","platforms":["Windows"],"analytic_id":"AN1857","source_url":"https://attack.mitre.org/detectionstrategies/DET0724#AN1857","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0082/"}]},{"id":"AN2122","name":"Analytic 2122","guidance":"Real-time monitoring identifies Secure Shell (SSH) or local authentication by an Industrial Control System (ICS) service or operator account from a source Internet Protocol (IP) address outside the approved administrative Classless Inter-Domain Routing (CIDR) subnet, or a sudo/su escalation event by an ICS service account that does not normally require interactive privilege escalation, correlated with subsequent execution of ICS engineering tools. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0724#AN2122","platforms":["Linux"],"tuning":[{"field":"ApprovedAdminCIDR","description":"IP ranges from which SSH administrative access to ICS Linux assets is authorized."},{"field":"ApprovedHostList","description":"Inventory of workstations/jump hosts from which ICS-role accounts are authorized to authenticate."},{"field":"ApprovedNMSCIDR","description":"IP ranges from which network device administrative access is authorized."},{"field":"AuthToDeviceWindow","description":"Time window after anomalous logon within which device-subnet connection is considered correlated, typically 5-15 minutes."},{"field":"ICSRoleAccountPatterns","description":"Naming convention or group-membership pattern identifying accounts with engineering, operator, or ICS service roles."},{"field":"OfficeHoursWindow","description":"Defined normal working hours for interactive ICS engineering activity, widened for 24/7 shift-based operations."}],"log_sources":[{"component_id":"DC0067","component":"Logon Session Creation","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): sudo/su success for Industrial Control Systems (ICS) service account UID without the expected automated invocation pattern","platforms":["Linux"],"analytic_id":"AN2122","source_url":"https://attack.mitre.org/detectionstrategies/DET0724#AN2122","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"},{"component_id":"DC0002","component":"User Account Authentication","name":"syslog:auth","channel":"sshd Accepted publickey/password for Industrial Control Systems (ICS)-role account from source not in approved admin CIDR","platforms":["Linux"],"analytic_id":"AN2122","source_url":"https://attack.mitre.org/detectionstrategies/DET0724#AN2122","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN2182","name":"Analytic 2182","guidance":"Real-time monitoring identifies network device management session authentication such as Secure Shell (SSH), Remote Authentication Dial-In User Service (RADIUS), and Terminal Access Controller Access-Control System Plus (TACACS+) using valid Industrial Control System (ICS) network administrator credentials but originating from source IPs outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet or at times inconsistent with the account's normal usage pattern, where the session performs configuration changes not reflected in any open change-control ticket. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0724#AN2182","platforms":["Network Devices"],"tuning":[{"field":"ApprovedAdminCIDR","description":"IP ranges from which SSH administrative access to ICS Linux assets is authorized."},{"field":"ApprovedHostList","description":"Inventory of workstations/jump hosts from which ICS-role accounts are authorized to authenticate."},{"field":"ApprovedNMSCIDR","description":"IP ranges from which network device administrative access is authorized."},{"field":"AuthToDeviceWindow","description":"Time window after anomalous logon within which device-subnet connection is considered correlated, typically 5-15 minutes."},{"field":"ICSRoleAccountPatterns","description":"Naming convention or group-membership pattern identifying accounts with engineering, operator, or ICS service roles."},{"field":"OfficeHoursWindow","description":"Defined normal working hours for interactive ICS engineering activity, widened for 24/7 shift-based operations."}],"log_sources":[{"component_id":"DC0002","component":"User Account Authentication","name":"networkdevice:aaa","channel":"TACACS+/RADIUS authentication success for Industrial Control Systems (ICS) network admin account from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet","platforms":["Network Devices"],"analytic_id":"AN2182","source_url":"https://attack.mitre.org/detectionstrategies/DET0724#AN2182","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"},{"component_id":"DC0038","component":"Application Log Content","name":"networkdevice:syslog","channel":"configuration change logged without corresponding change ticket reference following anomalous authentication","platforms":["Network Devices"],"analytic_id":"AN2182","source_url":"https://attack.mitre.org/detectionstrategies/DET0724#AN2182","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN2217","name":"Analytic 2217","guidance":"Real-time monitoring identifies field device access (Industrial Control System (ICS) protocol sessions, management interface authentication) using credentials or authentication tokens associated with a legitimate engineering account, but from a source Internet Protocol (IP) address or Media Access Control (MAC) address not enrolled as an authorized engineering workstation, where the authenticated session subsequently performs write operations the credential owner has not acknowledged via change control. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0724#AN2217","platforms":["Embedded"],"tuning":[{"field":"ApprovedAdminCIDR","description":"IP ranges from which SSH administrative access to ICS Linux assets is authorized."},{"field":"ApprovedHostList","description":"Inventory of workstations/jump hosts from which ICS-role accounts are authorized to authenticate."},{"field":"ApprovedNMSCIDR","description":"IP ranges from which network device administrative access is authorized."},{"field":"AuthToDeviceWindow","description":"Time window after anomalous logon within which device-subnet connection is considered correlated, typically 5-15 minutes."},{"field":"ICSRoleAccountPatterns","description":"Naming convention or group-membership pattern identifying accounts with engineering, operator, or ICS service roles."},{"field":"OfficeHoursWindow","description":"Defined normal working hours for interactive ICS engineering activity, widened for 24/7 shift-based operations."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"device authentication session from source Media Access Control (MAC)/Internet Protocol (IP) address not enrolled as authorized engineering workstation, with valid credential","platforms":["Embedded"],"analytic_id":"AN2217","source_url":"https://attack.mitre.org/detectionstrategies/DET0724#AN2217","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0088","name":"Logon Session Metadata","tag":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component"},{"id":"DC0082","name":"Network Connection Creation","tag":"Network Connection Creation","page":"telemetry/DC0082/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0089","name":"BlackEnergy","url":"https://attack.mitre.org/software/S0089","kind":"malware","description":"[BlackEnergy](https://attack.mitre.org/software/S0089) utilizes valid user and administrator credentials, in addition to creating new administrator accounts to maintain presence. (Citation: Booz Allen Hamilton)\n","relationship_id":"relationship--ee2fdebd-1587-4e53-a7d7-c15fcc88879d","references":[{"source_name":"Booz Allen Hamilton","description":"Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024.","url":"https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"}]},{"id":"S1045","name":"INCONTROLLER","url":"https://attack.mitre.org/software/S1045","kind":"malware","description":"[INCONTROLLER](https://attack.mitre.org/software/S1045)  can brute force password-based authentication to Schneider PLCs over  the CODESYS protocol (UDP port 1740).(Citation: CISA-AA22-103A)\n\n [INCONTROLLER](https://attack.mitre.org/software/S1045)  can perform brute force guessing of passwords to OPC UA servers using a predefined list of passwords.(Citation: CISA-AA22-103A)(Citation: Wylie-22) ","relationship_id":"relationship--6681bc38-0b55-4714-b690-c609956b40bf","references":[{"source_name":"CISA-AA22-103A","description":"DHS/CISA. (2022, May 25). Alert (AA22-103A) APT Cyber Tools Targeting ICS/SCADA Devices. Retrieved September 28, 2022.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-103a"},{"source_name":"Wylie-22","description":"Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.","url":"https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"}]}],"actors":[{"id":"G0049","name":"OilRig","url":"https://attack.mitre.org/groups/G0049","kind":"intrusion-set","description":"[OilRig](https://attack.mitre.org/groups/G0049) utilized stolen credentials to gain access to victim machines.(Citation: Dragos)","relationship_id":"relationship--f65a8ce8-90fa-4d92-a0dc-3ee544c541fe","references":[{"source_name":"Dragos","description":"Dragos   Chrysene Retrieved. 2019/10/27 ","url":"https://dragos.com/resource/chrysene/"}]},{"id":"G1000","name":"ALLANITE","url":"https://attack.mitre.org/groups/G1000","kind":"intrusion-set","description":"[ALLANITE](https://attack.mitre.org/groups/G1000) utilized credentials collected through phishing and watering hole attacks. (Citation: Dragos)","relationship_id":"relationship--0eb112f6-c1cb-4843-93f5-f668aa0e9bd8","references":[{"source_name":"Dragos","description":"Dragos   Allanite Retrieved. 2019/10/27 ","url":"https://dragos.com/resource/allanite/"}]}],"mitigations":[{"id":"M0801","name":"Access Management","url":"https://attack.mitre.org/mitigations/M0801","kind":"course-of-action","description":"Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.\n","relationship_id":"relationship--104b4f25-d0a9-41f6-94b3-fa85ee8b1523","references":[]},{"id":"M0913","name":"Application Developer Guidance","url":"https://attack.mitre.org/mitigations/M0913","kind":"course-of-action","description":"Ensure that applications and devices do not store sensitive data or credentials insecurely (e.g., plaintext credentials in code, published credentials in repositories, or credentials in public cloud storage). (Citation: CISA June 2013)\n","relationship_id":"relationship--b69f31c3-6c12-4b81-8e74-9c58ea635fa4","references":[{"source_name":"CISA June 2013","description":"CISA 2013, June Risks of Default Passwords on the Internet Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/ncas/alerts/TA13-175A"}]},{"id":"M0915","name":"Active Directory Configuration","url":"https://attack.mitre.org/mitigations/M0915","kind":"course-of-action","description":"Consider configuration and use of a network-wide authentication service such as Active Directory, LDAP, or RADIUS capabilities which can be found in ICS devices. (Citation: Keith Stouffer May 2015) (Citation: Schweitzer Engineering Laboratories August 2015)\n","relationship_id":"relationship--eeeaa0d4-0ca0-468e-ae13-43ab7aba61b4","references":[{"source_name":"Keith Stouffer May 2015","description":"Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"},{"source_name":"Schweitzer Engineering Laboratories August 2015","description":"Schweitzer Engineering Laboratories 2015, August Understanding When to Use LDAP or RADIUS for Centralized Authentication Retrieved. 2020/09/25 ","url":"https://cdn.selinc.com/assets/Literature/Publications/Application%20Notes/AN2015-08_20150817.pdf?"}]},{"id":"M0918","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M0918","kind":"course-of-action","description":"Ensure users and user groups have appropriate permissions for their roles through Identity and Access Management (IAM) controls. Implement strict IAM controls to prevent access to systems except for the applications, users, and services that require access. Implement user accounts for each individual for enforcement and non-repudiation of actions.\n","relationship_id":"relationship--1fc147bd-d6ab-4beb-908b-0fbe8e125b76","references":[]},{"id":"M0926","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M0926","kind":"course-of-action","description":"Audit domain and local accounts and their permission levels routinely to look for situations that could allow an adversary to gain system wide access with stolen privileged account credentials. (Citation: Microsoft May 2017) (Citation: Microsoft August 2018)These audits should also identify if default accounts have been enabled, or if new local accounts are created that have not be authorized. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. (Citation: Microsoft February 2019)\n","relationship_id":"relationship--111f437a-c67d-40e4-9515-7e9b22e65eff","references":[{"source_name":"Microsoft May 2017","description":"Microsoft 2017, May Attractive Accounts for Credential Theft Retrieved. 2020/09/25 ","url":"https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/attractive-accounts-for-credential-theft"},{"source_name":"Microsoft August 2018","description":"Microsoft 2018, August Implementing Least-Privilege Administrative Models Retrieved. 2020/09/25 ","url":"https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models"},{"source_name":"Microsoft February 2019","description":"Microsoft 2019, February Active Directory administrative tier model Retrieved. 2020/09/25 ","url":"https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material#a-nameesaebmaesae-administrative-forest-design-approach"}]},{"id":"M0927","name":"Password Policies","url":"https://attack.mitre.org/mitigations/M0927","kind":"course-of-action","description":"Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment. (Citation: CISA June 2013)\n","relationship_id":"relationship--a1383f2a-2ee2-47df-a661-8904a7535e0c","references":[{"source_name":"CISA June 2013","description":"CISA 2013, June Risks of Default Passwords on the Internet Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/ncas/alerts/TA13-175A"}]},{"id":"M0932","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M0932","kind":"course-of-action","description":"Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining access to valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information. MFA can also be used to restrict access to cloud resources and APIs.\n","relationship_id":"relationship--9b412b1f-2dd0-4e7f-8364-f625181ba1db","references":[]},{"id":"M0936","name":"Account Use Policies","url":"https://attack.mitre.org/mitigations/M0936","kind":"course-of-action","description":"Configure features related to account use like login attempt lockouts, specific login times, and password strength requirements as examples. Consider these features as they relate to assets which may impact safety and availability. (Citation: Keith Stouffer May 2015)\n","relationship_id":"relationship--ea817c7a-9424-4204-90a5-6f8fb86037be","references":[{"source_name":"Keith Stouffer May 2015","description":"Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"}]},{"id":"M0937","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M0937","kind":"course-of-action","description":"Consider using IP allowlisting along with user account management to ensure that data access is restricted not only to valid users but only from expected IP ranges to mitigate the use of stolen credentials to access data.\n","relationship_id":"relationship--5dfa5bad-8b0b-4884-bf01-04ea89e3ccf7","references":[]},{"id":"M0947","name":"Audit","url":"https://attack.mitre.org/mitigations/M0947","kind":"course-of-action","description":"Routinely audit source code, application configuration files, open repositories, and public cloud storage for insecure use and storage of credentials.\n","relationship_id":"relationship--baf7daf3-2116-4051-91b5-f82e146167d0","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0859":"/ttp-simulation/techniques/ics/T0859/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0859","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0082","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","initiated":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}}]}}