T0895 Autorun Image — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0748 Detection of Autorun Image

AN2066 Analytic 2066

Real-time monitoring identifies a field device loading a modified autorun image (boot read-only memory, bootloader firmware) detected by a discrepancy between the device's declared firmware hash and the authorized firmware inventory hash, with post-reboot device behavior diverging from expected (unexpected protocols active, unanticipated network connections). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2112 Analytic 2112

Real-time monitoring identifies modification of udev rules or autofs configuration that triggers script execution on removable media mount, where the triggered script path is not in the authorized Industrial Control System (ICS) software inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2273 Analytic 2273

Real-time monitoring identifies a registry write to Windows autorun keys or an AutoPlay/AutoRun configuration change referencing a binary path that is not part of the authorized Industrial Control System (ICS) software inventory, particularly in combination with removable media insertion. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.