T0892 Change Credential — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0771 Detection of Change Credential

AN1903 Analytic 1903

Real-time monitoring identifies Industrial Control System (ICS) protocol commands changing device-level credentials or access codes from a source not in the approved security administration list, where the device subsequently rejects connections from legitimate control system components. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2143 Analytic 2143

Real-time monitoring identifies passwd/chpasswd modification of Industrial Control System (ICS) service account credentials by a User Identifier (UID) that is not a designated system administrator, outside a formal credential rotation procedure. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2196 Analytic 2196

Real-time monitoring identifies network device credential changes such as Authentication, Authorization, and Accounting (AAA) password modification or Simple Network Management Protocol (SNMP) community string modification from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, corroborated by syslog showing authentication failures from legitimate NMS systems following the change. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2262 Analytic 2262

Real-time monitoring identifies a password change event for an Industrial Control System (ICS) service or operator account performed by an account not in the authorized credential administration role, immediately followed by failed authentication attempts from the Industrial Control System (ICS) service itself. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.