### Exploitation of ICS Protocols

Following the persistence phase, the adversary has initiated lateral movement within the ICS network. They are exploiting specific ICS protocols to move undetected between systems.

### Details of Exploitation
- **Exploited Protocols**: OPC UA, Modbus
- **Affected Systems**: SCADA controllers and PLCs
- **Lateral Movement Technique**: Credential dumping and pass-the-hash

### Defensive Measures
- Segregate ICS from corporate networks using firewalls.
- Regularly update and patch ICS components.

### Next Steps
Focus on identifying and mitigating data exfiltration attempts.