T0890 Exploitation for Privilege Escalation — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0738 Detection of Exploitation for Privilege Escalation

AN1871 Analytic 1871

Real-time monitoring identifies Industrial Control System (ICS) protocol commands succeeding against protected device functions from a source or session context that the device's documented access control model should reject, indicating exploitation of a vulnerability to bypass the device's privilege model. Documented as the core mechanism of the Triton attack, which exploited a zero-day in Triconex firmware while in PROGRAM mode. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2131 Analytic 2131

Real-time monitoring identifies a process owned by an Industrial Control System (ICS) service User Identifier (UID) executing a Set User Identifier (SUID) binary or exploiting a kernel vulnerability to obtain root privileges, detected via unexpected setuid/setgid syscalls from a process not invoked via sudo. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2191 Analytic 2191

Real-time monitoring identifies network device management commands succeeding from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, following exploit-pattern traffic to the device's management interface, suggesting exploitation of a management-plane vulnerability to gain elevated access without valid credentials. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2261 Analytic 2261

Real-time monitoring identifies an Industrial Control System (ICS) operator/service account being granted elevated Windows privileges without a corresponding administrative logon event, or a process crash in an Industrial Control System (ICS) vendor application immediately followed by a new process inheriting elevated token privileges. Documented in PIPEDREAM's LAZYCARGO component, which drops and exploits a known vulnerable ASRock driver to elevate credentials. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.