T1701 Command and Scripting Interpreter — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0928 Behavioral Detection of Command and Scripting Abuse in ICS

AN2082 Analytic 2082

Real-time monitoring identifies a command-line interpreter (cmd.exe, PowerShell.exe) spawned as a child of an Industrial Control System (ICS) vendor application process, where this parent-child relationship is not part of the documented normal operation of that vendor software or directly spawned processes with a command line parameters containing ICS protocol/Application Programming Interface (API) interaction keywords, from a context not associated with documented automation scripts. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2083 Analytic 2083

Real-time monitoring identifies a command and scripting interpreter process spawned by an Industrial Control System (ICS) service process, or interactive shell sessions from unexpected Secure Shell (SSH) source Internet Protocol (IP) addresses or an unexpected User Identifier (UID) not associated with recognized ICS automation scripts, deviating from the expected execution baseline. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2084 Analytic 2084

Real-time monitoring identifies an Industrial Control System (ICS) network-device command-line interface (CLI) commands (e.g., interface shutdown, access control list modification, network address translation changes, etc.) from a source or account outside the approved network-management baseline or network traffic patterns consistent with scripted command execution -- regular-interval connections with consistent payload sizes -- to field device Internet Protocol (IP) addresses from a host not normally exhibiting such regularity. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

AN2085 Analytic 2085

Real-time monitoring identifies a session (Telnet, SSH, proprietary, etc.) opened to an embedded field device from a source not in the approved administrative CIDR, immediately followed by configuration-mode entry or high-risk commands (firmware operations, config write/erase, reload) or identifies sequences of Industrial Control System (ICS) protocol commands arriving at field devices that follow a scripted, deterministic pattern -- identical inter-command timing, systematic address iteration -- rather than the variable, operator-driven timing of legitimate engineering sessions. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.