StellarProtect delivers patternless protection against both known and unknown malware via machine learning and ICS root of trust. ICS root of trust collects over a thousand ICS software certificates and licenses, verifying them in advance to reduce protection overhead. ICS endpoints often operate in a harsh environment, where they must output consistent and uninterrupted performance. StellarProtect can operate without an internet connection, using policies designed around "least privilege" to thwart both known and unknown malware as well as fileless attacks. StellarProtect continuously monitors the system to learn how users interact with ICS applications. With this information, it automatically determines whether an application can be trusted with access to files, the system library, or registry keys.