1200KM / detection
T0817 Drive-by Compromise — Detection Rules
Detection workspace for T0817 Drive-by Compromise: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0782 Detection of Drive-by Compromise
AN1914 Analytic 1914
Real-time monitoring identifies a browser process on an Industrial Control System (ICS) workstation spawning an unexpected child process immediately following navigation to an external website, particularly a vendor support or software-download site. Documented Havex precedent: adversaries compromised legitimate ICS vendor websites to serve trojanized software downloads. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
AN2147 Analytic 2147
Real-time monitoring identifies a browser process on an Industrial Control System (ICS) Linux workstation spawning child processes that execute with arguments inconsistent with normal browsing, or writing binaries to /tmp or user home directories. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
No reviewed association in this snapshot.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.