Update README.md

README.md

@@ -13,6 +13,7 @@ A collection of essential resources related cyber threat intelligence theory
 | [David J. Bianco](https://twitter.com/DavidJBianco) | Analysing relationships between the types of indicators you might use to detect an adversary's activities and how much pain it will cause them when you are able to deny those indicators to them | [the-pyramid-of-pain.html](https://detect-respond.blogspot.com/2013/03/the-pyramid-of-pain.html) |
 | Center for Cyber Intelligence Analysis and Threat Research | The Diamond Model: a novel model of intrusion analysis built by analysts, derived from years of experience | [diamond.pdf](https://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf?adlt=strict) |
 | [Lockheed Martin](https://en.wikipedia.org/wiki/Lockheed_Martin) | The Cyber Kill Chain® framework is part of the Intelligence Driven Defense® model for the identification and prevention of cyber intrusions activity. The model identifies what the adversaries must complete in order to achieve their objective | [Cyber_Kill_Chain.pdf](https://www.lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/Gaining_the_Advantage_Cyber_Kill_Chain.pdf) |
+| [SANS](https://www.sans.org/) | SANS shared a Cyber Kill Chain tailored to Industrial Control Systems (ICS), written by Michael J. Assante and Robert M. Lee. | [The Industrial Control System Cyber Kill Chain](https://github.com/curated-intel/CTI-fundamentals/blob/main/Archive/SANS%20-%20ICS%20Kill%20Chain%20-%20Whitepaper.pdf) |
 | [Mercyhurst University Institute for Intelligence Studies](https://en.wikipedia.org/wiki/Mercyhurst_University_Institute_for_Intelligence_Studies) | The Analyst’s Style Manual is a product intended to assist student analysts with the many perplexing and complex rules they should follow in producing written intelligence products | [analysts_style_manual.pdf](https://ncirc.bja.ojp.gov/sites/g/files/xyckuh326/files/media/document/analysts_style_manual.pdf) |
 | [Freddy M](https://no.linkedin.com/in/fmurre?trk=pulse-article_main-author-card) | The Intelligence Architecture Map is based on interviews of industry experts, former intelligence practitioners, and Freddy's personal views. It represents a logical and meaningful way of how different aspects of producing intelligence should be put together. | [intelligence-architecture-map-freddy-m](https://www.linkedin.com/pulse/intelligence-architecture-map-freddy-m/) |
 | [Grace Chi](https://twitter.com/euphoricfall) | IS SHARING CARING? A comprehensive study on the current cyber threat intelligence inter-personal and social networking practices, results, and attitudes | [ctinetworkingreport2022.pdf](https://pulsedive.com/downloads/ctinetworkingreport2022.pdf) |