Detections

Detect successful Office Suite access using an authentication method that does not perform the account's expected MFA flow, correlated within ASPActivityWindow with first-seen client/application access, an anomalous source/device, or an ASP-related account credential change where available.

Detect successful SaaS authentication through an application-specific or legacy credential mechanism from a source/client not previously associated with that account, correlated with new session establishment or subsequent access inconsistent with ApprovedASPUsage.

An analyst observes an AI agent access $ProtectedDataScope$, invoke a tool/API using that information or a derived payload, and the destination service record a successful transfer to a recipient, repository, tenant, domain, or service outside $AuthorizedAIDataFlows$.

An analyst observes an AI-associated process access data outside $AuthorizedAIDataScope$, followed within $EndpointExfilWindow$ by transfer-capable execution and an outbound connection to a destination outside $AuthorizedAIEndpoints$ from the same process lineage.

An analyst observes an AI-associated process access data outside $AuthorizedAIDataScope$, followed within $EndpointExfilWindow$ by transfer-capable execution and an outbound connection from the same lineage to a destination outside $AuthorizedAIEndpoints$.

Real-time monitoring identifies a command-line interpreter (cmd.exe, PowerShell.exe) spawned as a child of an Industrial Control System (ICS) vendor application process, where this parent-child relationship is not part of the documented normal operation of that vendor software or directly spawned processes with a command line parameters containing ICS protocol/Application Programming Interface (API) interaction keywords, from a context not associated with documented automation scripts. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a command and scripting interpreter process spawned by an Industrial Control System (ICS) service process, or interactive shell sessions from unexpected Secure Shell (SSH) source Internet Protocol (IP) addresses or an unexpected User Identifier (UID) not associated with recognized ICS automation scripts, deviating from the expected execution baseline. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an Industrial Control System (ICS) network-device command-line interface (CLI) commands (e.g., interface shutdown, access control list modification, network address translation changes, etc.) from a source or account outside the approved network-management baseline or network traffic patterns consistent with scripted command execution -- regular-interval connections with consistent payload sizes -- to field device Internet Protocol (IP) addresses from a host not normally exhibiting such regularity. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a session (Telnet, SSH, proprietary, etc.) opened to an embedded field device from a source not in the approved administrative CIDR, immediately followed by configuration-mode entry or high-risk commands (firmware operations, config write/erase, reload) or identifies sequences of Industrial Control System (ICS) protocol commands arriving at field devices that follow a scripted, deterministic pattern -- identical inter-command timing, systematic address iteration -- rather than the variable, operator-driven timing of legitimate engineering sessions. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies direct PowerShell execution or indirect System.Management.Automation use with an unexpected parent, encoded/obfuscated arguments, unusual module loading, or execution followed by OT-relevant network/process activity. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.

Real-time monitoring identifies cmd.exe or .bat/.cmd execution from an unexpected parent or user context, execution from transient/user-writable paths, suspicious command chaining, or shell activity followed by OT-relevant discovery, credential, remote-access, or configuration behavior. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.

Real-time monitoring identifies sh/bash/ash/zsh/BusyBox execution from an unexpected parent, unauthorized account, remote session, or non-approved script path, particularly when followed by OT-relevant network discovery, persistence, file modification, or communications. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.

Real-time monitoring identifies network-device CLI or underlying Unix-like shell access from an unauthorized management source/account, followed by privileged or configuration commands outside an approved change window. Do not alert solely on CLI use. Require violation of the management matrix, command authorization, or change-control context.

Real-time monitoring identifies shell/CLI access to an embedded controller, gateway, HMI appliance, or IoT/OT device from an unauthorized source/account, or command execution that is inconsistent with the device role and approved maintenance workflow. Require a session/command authorization violation or corroborating configuration/firmware/process effect; do not infer maliciousness from deterministic timing alone.

Real-time monitoring identifies wscript.exe/cscript.exe, Office macro, or HTA-driven Visual Basic execution from unexpected parents/paths or followed by PowerShell, command shell, network activity, or system modification. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.

Real-time monitoring identifies wscript.exe/cscript.exe/mshta.exe or other JScript execution from unexpected parents/paths, especially when followed by child interpreters, network connections, or system modification. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.

Real-time monitoring identifies node/nodejs or another JavaScript runtime launched from an unexpected service, web process, scheduled task, user, or path, followed by outbound connections, shell execution, persistence, or OT-relevant access. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.

Real-time monitoring identifies python.exe/py.exe or packaged Python runtimes launched from unexpected parents or locations, by unauthorized identities, or followed by communications to protected OT assets, system modification, or child interpreters. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.

Real-time monitoring identifies python/python3 execution by unexpected users/services, from unapproved script paths, or from cron/systemd contexts not associated with documented automation, particularly when followed by OT communications, sensitive file access, persistence, or child-shell activity. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.

Real-time monitoring identifies an embedded OT/IoT device sending DNS to a resolver not defined for its role, tunneling-like native DNS, or direct HTTPS/TLS to an unapproved DoH endpoint. Because many embedded devices have fixed communications, require deviation from the device-specific resolver/destination profile and corroborating query or destination evidence.

Real-time monitoring identifies ICS clients sending DNS directly to unauthorized resolvers, native DNS with tunneling characteristics, or HTTPS/TLS connections to known/identified DoH infrastructure that bypass the site resolver/proxy architecture. Alert on policy violation plus content/flow corroboration; do not alert solely on high DNS volume.

Real-time monitoring identifies a Linux ICS asset bypassing designated DNS resolvers, producing tunneling-like native DNS, or connecting to unapproved DoH/DoT infrastructure from an unauthorized process/service. Require resolver-policy or asset-role violation plus corroborating process, query, or destination evidence; suppress approved package/vendor/security workflows.

Real-time monitoring identifies an ICS Windows asset bypassing designated DNS resolvers, generating tunneling-like DNS content, or establishing HTTPS/TLS sessions to unapproved DoH resolver/API infrastructure from a process not authorized for encrypted DNS. Require a resolver-policy or asset-role violation plus suspicious query/content/process/destination evidence; suppress approved browsers, security products, vendor cloud services, and documented maintenance.

Real-time monitoring identifies a Windows ICS asset initiating MQTT/AMQP/DDS communications to a broker/service not approved for the asset role, from a process not associated with authorized vendor or telemetry software. Require both a communication-matrix violation and destination/process/protocol corroboration; suppress approved brokers, telemetry collectors, vendor applications, and maintenance.

Real-time monitoring identifies a Linux ICS service or process initiating MQTT/AMQP/DDS communications outside its approved broker/client relationship or from an unauthorized runtime/tool. Require communication-matrix violation plus process/destination/protocol corroboration; suppress approved telemetry, historian, gateway, vendor, and maintenance activity.