ICS Intrusion Kill Chain Explained
Javier Perez and Juan Escobar deconstruct the ICS Cyber Kill Chain, mapping adversary stages from initial IT ingress to OT process manipulation.
Summary
The Distinct Dynamics of ICS Cyber Attacks
Unlike traditional IT data theft campaigns, cyber attacks against industrial control systems require deep familiarity with automated engineering processes and physical safety systems.
Deconstructing the Two-Stage ICS Cyber Kill Chain
Javier Perez and Juan Escobar examine the Michael Assante and Robert M. Lee ICS Kill Chain model, distinguishing Stage 1 (IT intrusion and preparation) from Stage 2 (OT execution and disruption).
Mapping Real-World Adversary Campaigns
The authors analyze historic campaigns (including Sandworm and Xenotime), illustrating how attackers establish beachheads, learn engineering workflows, and deploy destructive OT payloads.
Actionable Chokepoints for Incident Responders
Perez and Escobar identify key defensive detection chokepoints to intercept adversaries before they transition into Stage 2 execution.
Related talks
BlueHat India 2025·25 min
Presenters detail vulnerability discovery and exploitation in Incident Response in Virtual Infrastructure: Combating APT and eCrime Threats.
Community Stage·36 min
N Case · J McCoy
Analyzes real-world breaches in research laboratories and manufacturing facilities to examine how nation-state actors exploit human error and misconfigurations.
Creator Stage·24 min
Cybelle Oliveira
Examines how climate change impacts water and energy infrastructure and how advanced persistent threat groups exploit these stressed OT environments.