Exploitation for Privilege Escalation (T0890) is the ICS counterpart of Enterprise T1068: a software flaw is used to turn limited access into SYSTEM, root or supervisor rights. ATT&CK for ICS builds its description on the Enterprise technique, and most of the defensive work (patching, exploit protection, least privilege) is the same. What differs in OT is where it happens and what the elevated rights unlock: an engineering workstation that can program controllers, or the firmware of a safety controller itself. This short guide covers only those OT differences, with the two procedure examples ATT&CK lists. For the general technique see the T1068 Exploitation for Privilege Escalation guide.
Key takeaways
- Same technique, wider platform list. ATT&CK v20 lists T0890 for Embedded, Windows, Linux and Network Devices, so field controllers are in scope as well as OT servers.
- Both procedure examples are serious. TRITON used a previously unknown Triconex firmware flaw to gain supervisor privileges, and INCONTROLLER used a vulnerable signed driver to load its own unsigned driver on Windows.
- Patching is slower in OT, so compensating controls carry the load. ATT&CK lists Exploit Protection, Application Isolation and Sandboxing, Update Software and a Threat Intelligence Program.
- Detection looks at privilege outcomes. ATT&CK's analytics flag privileged results that the normal access model should not allow, such as a protected controller function succeeding without the documented elevation sequence.
- Response must account for safety systems. Elevated access on a safety controller or its engineering workstation is a process safety event, not only an IT incident.
What differs in OT
ATT&CK for ICS places T0890 in the Privilege Escalation tactic and describes it in the same terms as T1068: exploiting a programming error in a program, service, operating system or kernel to execute code with higher permissions, typically moving from user level to SYSTEM or root. Three things change in an industrial setting.
| Area | Enterprise T1068 | OT reality for T0890 |
|---|---|---|
| Targets | Workstations, servers, kernels, drivers | Also HMIs, engineering workstations, historians, network devices and controller firmware (Embedded) |
| What elevation unlocks | Credential access, defence evasion, domain compromise | Ability to program controllers, alter safety logic or write to protected controller memory |
| Patching | Usually days to weeks | Often tied to vendor qualification and outage windows, so exposure lasts longer |
| Endpoint controls | EDR and exploit protection widely deployed | Vendor support statements decide what can run on ICS hosts; test before turning on |
For how to run vendor advisories through to remediation in OT, see the ICS Advisory Triage and OT Vulnerability Management Guide and the OT Patch Management Guide.
Procedure examples
- Triton (S1009): ATT&CK records that Triton exploited a previously unknown vulnerability in Tricon MP3008 firmware through an insecurely written system call, giving a memory write primitive used to gain supervisor privileges. Mandiant's analysis of the 2017 incident describes the attacker reaching a safety instrumented system (SIS) engineering workstation and deploying TRITON, and some SIS controllers entering a failed safe state that shut down the process. Mandiant recommends keeping the Triconex key switch out of PROGRAM mode outside scheduled events, separating safety networks from process control and IT networks, and application allowlisting on any Windows host that can reach the SIS. See the Safety Instrumented Systems Security Guide.
- INCONTROLLER (S1045): ATT&CK records that it can exploit a vulnerable ASRock driver (AsrDrv103.sys, CVE-2020-15368) to load its own unsigned driver. This is a bring your own vulnerable driver pattern on a Windows host in the OT network; see the Bring Your Own Vulnerable Driver and EDR Killers Guide.
ATT&CK lists no groups or campaigns for T0890 in v20. For the wider malware history see the ICS Malware History Guide.
Mitigations and detection
| ATT&CK mitigation | What ATT&CK says | OT application |
|---|---|---|
| M0950 Exploit Protection | Security applications that look for exploitation behaviour, and control flow integrity checking | Turn on exploit protection in audit mode on HMIs and engineering hosts first, within the ICS vendor's support statement |
| M0948 Application Isolation and Sandboxing | Sandboxing, virtualisation and microsegmentation to limit the impact of unpatched flaws | Isolate engineering and safety workstations; no dual-homing to IT |
| M0951 Update Software | Regular patch management for endpoints and servers | Prioritise hosts that can program controllers or reach safety systems; apply vendor-qualified patches in each outage window |
| M0919 Threat Intelligence Program | Understand which threats may use exploits and zero-days against the organisation | Track ICS advisories for every product in the asset inventory |
ATT&CK v20 detection strategy DET0738 has one analytic per platform:
- Embedded (AN1871): a protected function such as a firmware write or memory protection change succeeding for a session that did not complete the documented authentication or elevation sequence, or a device crash or restart followed by a privileged command from the same session. ATT&CK cites TRITON as the documented case.
- Windows (AN2261): an ICS operator or service account receiving special privileges (Security event 4672) without a matching administrative logon, and Sysmon event 6 (driver loaded) for a known vulnerable third-party driver just before the privilege change.
- Linux (AN2131): a process owned by an ICS service account gaining root through setuid or setgid calls not invoked through sudo, captured by auditd rules.
- Network Devices (AN2191): management commands succeeding from outside the approved network management subnet after exploit-like traffic to the management interface.
Each carries ATT&CK's operational fidelity gate: suppress vendor-signed software and approved engineering tools, and alert when the activity violates the approved allowlist or comes from an unauthorised user or tool. Measures worth tracking: percentage of ICS hosts with exploit protection on (audit or enforce), time from ICS advisory to mitigation for hosts that can program controllers, number of vulnerable driver loads blocked or alerted, and percentage of safety controllers with key switches audited each quarter. Feed the analytics into the OT Security Operations Centre Guide process.
Where identity fits
Elevation targets the accounts that run OT software. ATT&CK's Windows analytic centres on ICS operator and service accounts, and those accounts are frequently shared and long-lived. Give each service the minimum rights it needs, keep engineering logons named, and remove local administrator rights from operator accounts so that an exploit gains less. See the OT and ICS Identity and Access Guide.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SI-2 Flaw Remediation, SI-16 Memory Protection, AC-6 Least Privilege, RA-5 Vulnerability Monitoring and Scanning | Patch, protect memory, limit what an exploit gains, find the flaws |
| NIST CSF 2.0 | ID.RA-01, PR.PS-01, DE.CM-09 | Vulnerabilities identified, configuration managed, software and runtime monitored |
| ATT&CK Enterprise | T1068 Exploitation for Privilege Escalation | The source technique for T0890's description |
Practitioner checklist
- Map every ICS host and controller to its vendor advisories and track flaws that grant elevated rights.
- Patch hosts that can program controllers or reach safety systems first, in each outage window.
- Turn on exploit protection and a vulnerable driver blocklist in audit mode, then enforce where the vendor supports it.
- Keep safety controller key switches out of PROGRAM mode outside scheduled work and audit them.
- Remove local administrator rights from operator and service accounts where the software allows.
- Collect Windows Security 4672, Sysmon driver loads and Linux auditd setuid events from OT hosts.
- Watch controller diagnostics for protected functions succeeding without the normal elevation sequence.
Standards and references
- MITRE ATT&CK for ICS: T0890 Exploitation for Privilege Escalation
- MITRE ATT&CK: T1068 Exploitation for Privilege Escalation
- MITRE ATT&CK: S1009 Triton
- MITRE ATT&CK: S1045 INCONTROLLER
- Mandiant: Attackers Deploy New ICS Attack Framework TRITON
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
Related NHI Mgmt Group resources: T1068 Exploitation for Privilege Escalation · Safety Instrumented Systems Security Guide · OT Patch Management Guide · MITRE ATT&CK for ICS Guide