The document discusses the Trisis malware attack on a safety system at a gas facility in Saudi Arabia in 2017, highlighting its impact and the ongoing threat from the Xenotime group which has expanded its targeting. It offers defensive recommendations for industrial control systems (ICS), emphasizing the importance of monitoring, isolation, and robust network defenses against cyber threats. Additionally, it stresses the need for effective incident response capabilities, including forensic analysis and system recovery planning.

1. TRISIS in Perspective
Implications of Safety System Attacks
for ICS Defenders

2. Place Your Header Here in Arial 22pt
Place Subtitle Here
Agenda
• TRISIS Event
• TRISIS Malware
• XENOTIME Activity Group
• Defensive Recommendations

3. TRISIS Event
Unspecified gas facility in Saudi Arabia attacked in August 2017.
Infection resulted in system shutdown during the intrusion.
Not assessed as a shutdown due to an attack (accidental).
Attack focused on Schneider Electric Triconex Safety System (SIS).

4. TRISIS Attack Progression
Establish
Access on
SIS-
Connecting
System
Transfer
TRISIS
Package to
System
Use TRISIS
Base EXE to
Upload
Tristation
Program
Tristation
Program
Compromises
SIS
Leverage
Access for
ICS
Disruption via
SIS

5. Establish
Access on
SIS-
Connecting
System
Transfer
TRISIS
Package to
System
Use TRISIS
Base EXE to
Upload
Tristation
Program
Tristation
Program
Compromises
SIS
Leverage
Access for
ICS
Disruption via
SIS
TRISIS Attack - Observed
Something breaks here! (maybe)

6. TRISIS Malware exploits and installs rootkit on SIS
Engineering
Workstation
LIBRARY.ZIP +
TRILOG.EXE
SIS
INJECT.BIN IMAIN.BIN

7. TRISIS Activity Group: XENOTIME
Deliberate targeting of SIS accepts risk of physical damage and potential
loss of life.
New ‘norm’ established in ICS targeting and operations.
Post-TRISIS, we have observed that XENOTIME has expanded its targeting to
North America and other safety systems.
XENOTIME isn’t simply a problem for Schneider Triconex customers.

8. ICS Cyber Kill Chain – Focus on Stage 2

9. SIS Connectivity – Isolation isn’t always possible
Increasing connectivity requirements
results in SIS connectivity to general
network.
Yokogawa ProSafe-RS recommends that
SIS connected to rest of network.
Honeywell Safety Manager docs provide
similar guidance.

10. Border Defense – Stopping Stage 2
• Look for Credential Theft and Re-Use.
• Remote logon activity should route through a hardened jump host for
better monitoring.
• If not possible, implement host-based logging visibility on border
hosts from IT to ICS along with network monitoring host to host.
• File Monitoring
• Unknown ICS malware will often evade AV (known limitation).
• AV effective for supplementary tools like Mimikatz.
• Open source: Bro + Yara for files of interest crossing border.
• Command and Control Detection – outbound activity from ICS

11. ICS Network Defense – Choke Points and Pivoting
• Following initial access, attacker
must pivot through network to reach
host of interest.
• Architectural decisions can limit
adversary freedom of movement.
• Treat choke points like IT-ICS
boundary.
• Most effective: physical/virtual LAN
segmentation. Install taps for better
visibility.

12. SIS Monitoring and Defense
• Assumption: adversary has breached network and has access to SIS.
• Harden SIS-Connected hosts, such as EWS, to the greatest extent possible.
• Patching
• Limit local and admin accounts as well as remote access.
• Logging (Sysmon, Windows event log)
• Treat SIS-connected hosts as a choke point.
• Physical Defense: Isolate as much as possible. Use keyswitch-like controls.
• Monitor Traffic Flow to SIS.
• Organizational awareness of known maintenance periods

13. SIS Response and Recovery – Plan Ahead
• Forensics and Root Cause Analysis
• TRISIS victim was able to determine a cyber event was involved in plant
shutdown. This is often overlooked.
• Assess capability to obtain forensics artifacts from the SIS.
e.g. Control Program Audits
• Ensure robust forensic capability on SIS-connected devices, to enable
determination of cyber involvement.
• System Restoration and Recovery
• Known Good configuration secure backups (firmware if possible)
• Develop response plan. Engage Vendor contacts early.

14. Start Now with SIS Defense
XENOTIME is still learning.
The playing field is level, so we have time for designing defense.
Questions?

15. Sources and References
• Yokogawa SIS Prosafe-RS Documenation
https://tinyurl.com/ybtkwxfw
• Honeywell Safety Manager Specifications and Technical Data
https://tinyurl.com/yde2tgwy
• The Bro Network Security Monitor
https://www.bro.org/
• Yara: The Pattern Matching Swiss Knife for Malware Researchers
https://virustotal.github.io/yara/
• Sysmon – Microsoft
https://tinyurl.com/y9bcgolz

16. Sources and References
• Windows Security Event ID 4624
https://tinyurl.com/zaklujy
• TRISIS – Initial Release
https://dragos.com/blog/trisis/
• TRISIS and Xenotime webinars:
Analyzing TRISIS – Reid Wightman & Jimmy Wylie
XENOTIME and SIS – Joe Slowik
https://dragos.com/webinars.html