Detections

Real-time monitoring identifies MQTT/AMQP/DDS sessions crossing an unexpected zone boundary, connecting an ICS client to an unapproved broker/service, or using client/topic/message behavior inconsistent with the documented pub/sub architecture. Require topology/identity/topic/destination violation; periodicity alone is not sufficient.

Real-time monitoring identifies an embedded OT/IoT device establishing MQTT/AMQP/DDS communication with a broker/service outside its device-specific profile, using an unexpected client identity/topic, or crossing an unauthorized zone boundary. Fixed-function device behavior should be compared to the documented broker/topic/destination profile rather than a generic anomaly threshold.

Successful CAPTCHA completion does not expose whether the challenge was solved manually, through automated tooling, through an AI-enabled solver, or through a third-party human-solving service. Providers may independently classify associated sessions as automated or bot-like, but this identifies suspicious automation rather than the method used to complete the CAPTCHA.

No target-side behavioral Detection Strategy exists for Avoid CAPTCHA based solely on CAPTCHA telemetry.

No target-side behavioral Detection Strategy exists for CAPTCHA based solely on CAPTCHA telemetry.

Real-time monitoring identifies a write to alarm configuration files on a Linux-based Supervisory Control and Data Acquisition (SCADA)/alarm server by a User Identifier (UID) that is not the alarm management service, or the alarm management service process receiving Application Programming Interface (API) calls that suppress alarm classes without a corresponding operator session. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a write to alarm configuration files or database tables on an Human-Machine Interface (HMI)/alarm server by a process other than the recognized alarm management application, or an alarm-class-disable Application Programming Interface (API) call logged without a corresponding operator session ID in the HMI audit trail. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Periodic or event-triggered integrity verification identifies field devices with firmware or configuration that differs from the vendor-published authorized baseline, detected by comparing device firmware hashes against the authorized firmware inventory, appearing immediately after a vendor-supplied update or hardware replacement. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Monitoring reality: this is an integrity/posture analytic, not a universal streaming field-device event; collection cadence depends on the vendor integrity interface, asset-management system, or acquisition workflow.

Real-time monitoring identifies a process setting LD_PRELOAD before launching an Industrial Control System (ICS) service binary, or writing to /etc/ld.so.preload, where the injected library path is not part of the vendor's package manifest. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an Industrial Control System (ICS) vendor software package whose installation, via package manager, creates unexpected files or starts unrecognized services not documented in the vendor's package manifest. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies modification of udev rules or autofs configuration that triggers script execution on removable media mount, where the triggered script path is not in the authorized Industrial Control System (ICS) software inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies truncation or deletion of Industrial Control System (ICS) application or auth log files, or modification of bash history, by a User Identifier (UID) that does not normally manage log rotation. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies bulk file access on a Linux-hosted Industrial Control System (ICS) documentation repository (piping and instrumentation diagram stores, configuration archives) by a User Identifier (UID) not associated with documented engineering roles. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a process on an Industrial Control System (ICS) Linux asset with both a listening socket on an ICS protocol port and an outbound connection to a non-ICS destination, combined with iptables DNAT rules redirecting ICS protocol port traffic. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies a write to Industrial Control System (ICS) project file paths on a Linux engineering station from a User Identifier (UID) not associated with the ICS engineering tool, or from the tool after loading a file from a removable media or network path not in the approved software distribution list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a write to alarm threshold configuration files on a Linux-based alarm server by a User Identifier (UID) that is not the alarm management service. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies iptables/nftables rule additions on Industrial Control System (ICS) Linux gateways that filter ICS command messages based on content, while allowing other traffic to pass. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies writes to serial device configuration files or `stty` commands changing serial port parameters on Industrial Control System (ICS) Linux gateway hosts from a User Identifier (UID) not associated with authorized serial port management. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a write to a Siemens project file path on a Linux engineering workstation from a User Identifier (UID) not associated with the Siemens engineering tool runtime. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an Industrial Control System (ICS) Linux service process (historian daemon, Open Platform Communications (OPC) gateway) being killed or crashing following a sustained high-rate inbound connection pattern recorded by network monitoring, correlated with daemon log entries indicating connection limit exhaustion or out-of-memory conditions. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.

Real-time monitoring identifies Secure Shell (SSH) or local authentication by an Industrial Control System (ICS) service or operator account from a source Internet Protocol (IP) address outside the approved administrative Classless Inter-Domain Routing (CIDR) subnet, or a sudo/su escalation event by an ICS service account that does not normally require interactive privilege escalation, correlated with subsequent execution of ICS engineering tools. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a process whose executable name matches a known Industrial Control System (ICS) service daemon but whose execution path falls outside the documented vendor installation directories, or whose binary hash does not match the package manager's recorded checksum for that package. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a process executing iwconfig or ip link set promisc, or loading mac80211 monitor mode, on an Industrial Control System (ICS) Linux asset outside normal configuration management activity. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a scripting interpreter or custom binary on an Industrial Control System (ICS) Linux asset making sustained, high-frequency Industrial Control System (ICS) protocol read connections to field device IPs, from a User Identifier (UID) not associated with the recognized historian or Supervisory Control and Data Acquisition (SCADA) service account. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a firmware update utility on an Industrial Control System (ICS) Linux engineering host initiating a connection to a device Internet Protocol (IP) address on its firmware update port, by a User Identifier (UID) not in the approved firmware manager UIDs, outside a scheduled maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.