Detections

Real-time monitoring identifies Industrial Control System (ICS) protocol commands succeeding against protected device functions from a source or session context that the device's documented access control model should reject, indicating exploitation of a vulnerability to bypass the device's privilege model. Documented as the core mechanism of the Triton attack, which exploited a zero-day in Triconex firmware while in PROGRAM mode. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies execution of network discovery tools (nmap, PLCScan, redpoint NSE scripts) or Industrial Control System (ICS)-specific scanners from an Industrial Control System (ICS) Windows host, from a process not associated with a recognized network management or engineering tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an internet-facing Industrial Control System (ICS) application server, web Human-Machine Interface (HMI), historian web interface, vendor remote access portal) process spawning an unexpected child process immediately following an inbound web request containing exploit-pattern content. Documented across multiple incidents involving internet-exposed ICS web interfaces. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Analyst implementation must limit predicates to fields actually retained by the web server/WAF (for example URI/path/query/header/status/source); request-body or payload signatures require WAF/DPI or request-body logging and must not be inferred from a basic access log.

Real-time monitoring identifies an Industrial Control System (ICS) protocol write to a controller's task/organization-block configuration from a source not in the approved engineering workstation list, correlated against post-modification cycle timing deviation. Documented precedent: Stuxnet infected Siemens OB1 (main execution cycle block) so its malicious payload ran every cycle, and infected OB35 (watchdog/interrupt block) to suppress error reporting. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an unrecognized process on an ICS Linux host loading an ICS/vendor shared library that is normally restricted to approved control or engineering applications. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies indirect evidence of passive RF capture on Industrial Control System (ICS) wireless frequencies -- an unassociated device's RF signature detected without a completed association sequence, or a known device's Media Access Control (MAC) address detected from a location/signal strength inconsistent with its registered installation point. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a device establishing its first network connection to Industrial Control System (ICS) application servers from an Internet Protocol (IP) address or Media Access Control (MAC) address not previously seen in the environment, immediately following a new device association event on the network. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a file written to an Industrial Control System (ICS) host from a remote network share, where the file has an executable or script extension, immediately followed by execution of that file from the same path. Documented in the PIPEDREAM toolkit's modular design, where components transfer files to compromised Programmable Logic Controllers (PLCs) and engineering workstations. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host injecting spoofed reporting messages into the Supervisory Control and Data Acquisition (SCADA) data path -- Open Platform Communications Unified Architecture (OPC UA) data change notifications with fabricated values, or historian tag writes that override device-sourced values -- from a process that is not the recognized data acquisition process. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

No standard detection method currently exists for this technique.

Monitor Windows Security Event ID 4663 on explicitly audited ICS data paths and correlate repeated ReadData/ListDirectory access across multiple sensitive files or directories by an account/process outside the approved engineering, backup, or application baseline. This requires Object Access auditing and SACLs on the monitored paths; Sysmon does not provide generic file-read telemetry. Alert when the bulk-read pattern occurs outside an approved backup/export window or is followed by staging, compression, or network transfer.

Real-time monitoring identifies an audit log clearing event or deletion/truncation of an Industrial Control System (ICS) vendor application log file, immediately preceded by other suspicious activity on the same host within a short lookback window. Documented in the CaddyWiper deployment alongside Industroyer2, explicitly intended to destroy evidence and slow forensic recovery. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies execution of screenshot utilities (scrot, import, xwd) on an Industrial Control System (ICS) Linux Human-Machine Interface (HMI), from a User Identifier (UID) that does not normally perform display operations. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an Industrial Control System (ICS) protocol session consistent with a program download to a field device from a source not in the approved engineering workstation list, correlated with a device mode-change alarm transitioning to PROGRAM/STOP immediately preceding the transfer. Documented in Stuxnet (code/data block download to alter programmable logic controller behavior) and Triton (TriStation protocol program download to the Triconex Safety Instrumented System). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host making direct native Operating System (OS) Application Programming Interface (API) calls that bypass the normal ICS vendor Software Development Kit (SDK) abstraction layer -- direct CreateFile calls against raw device paths, DeviceIoControl calls to ICS hardware driver handles -- from a process not a recognized vendor application. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies access to Industrial Control System (ICS) documentation repositories by an account or session context not associated with documented engineering roles, immediately followed by bulk file access or archive creation. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an Industrial Control System (ICS) protocol mode-change command targeting a field device from a source not in the approved engineering workstation list, where the transition is not immediately followed by a corresponding operator acknowledgment. Documented in Triton (the Tricon controller had to be placed in PROGRAM mode before the attack could inject its payload). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies successful authentication to an Industrial Control System (ICS) application such as a Human-Machine Interface (HMI), historian, Supervisory Control and Data Acquisition (SCADA) server using credentials matching known default vendor passwords, from a logon source not associated with any authorized user. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

No standard detection method currently exists for this technique.

Real-time monitoring identifies a process performing rapid, bulk deletion or overwrite of files across multiple Industrial Control System (ICS)-relevant directories within a short time window, by a process not associated with documented data retention management, correlated with a system crash shortly after. Documented in CaddyWiper, deployed via GPO alongside Industroyer2. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a Linux process with both a listening socket on an Industrial Control System (ICS) protocol port and an outbound connection to a non-ICS destination, or iptables DNAT/REDIRECT rules added on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

On Windows and Unix systems monitor executed commands and arguments that may use shell commands for execution. Shells may be common on administrator, developer, or power user systems depending on job function.

On network device and embedded system CLIs consider reviewing command history if unauthorized or suspicious commands were used to modify device configuration. Monitor logs from installed applications (e.g., historian logs) for unexpected commands or abuse of system features. Monitor for processes spawning from known command shell applications (e.g., PowerShell, Bash). Benign activity will need to be allow-listed. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools.

Real-time monitoring identifies an Industrial Control System (ICS) protocol session reading back the user program from a field device to a source not in the approved engineering workstation list, where the session byte count is consistent with a substantial portion of the device's program memory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

No standard detection method currently exists for this technique.

No standard detection method currently exists for this technique.