2019 ICS Cyber Security Conference | USA

Attackers, including ICS-targeting adversaries, are increasingly using the same toolsets for a myriad of reasons.  It cuts down on development time, allows for lower attribution rates and gives attackers more “playbooks” to fall back on.  The near ubiquitous nature of Mimikatz -- utilized by the most dangerous ICS-specific adversary, XENOTIME -- is just one example.  Attackers are rapidly integrating other tools such as Metasploit, PowerShell Empire and Cobalt Strike into their tactics, techniques and procedures (TTPs). This presentation will discuss the evolution of ICS attacker techniques and provide defenders with methods to mitigate against them.