Detections

Real-time monitoring identifies unauthorized Switch Port Analyzer (SPAN) session configuration or port mirroring enabled from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) on an Industrial Control System (ICS) switch. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies authentication attempts against Industrial Control System (ICS) network device management interfaces using default or hardcoded vendor credentials from sources not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a switch interface transitioning to administratively-down state on a port connected to an Industrial Control System (ICS) field device, from a configuration change source not in the approved network administration list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a mass deauthentication event targeting multiple enrolled Industrial Control System (ICS) wireless devices simultaneously, or a wireless access point configuration change excluding enrolled device Media Access Control (MAC) address from the association list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host querying device operating state or process values via vendor Application Programming Interfaces (APIs) at a frequency or scope exceeding documented Human-Machine Interface (HMI) refresh behavior, from a process not in the recognized HMI/Supervisory Control and Data Acquisition (SCADA) application list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an Industrial Control System (ICS) Windows application such as a Supervisory Control and Data Acquisition (SCADA) server or Distributed Control System (DCS) interface generating anomalously high-frequency write Application Programming Interface (API) calls to field devices, exceeding the configured scan rate baseline for that point. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Monitor OPC UA server audit events for state-changing Write or Method service invocations and compare ClientUserId, ClientApplicationUri, SourceNode/MethodId, status, and arguments with the approved client/method baseline. For servers that support auditing, AuditWriteUpdateEventType and AuditUpdateMethodEventType provide an analyst-visible record of writes and state-changing method calls. Alert on successful or attempted control operations from unapproved clients/users or against methods/nodes outside the documented engineering workflow; do not describe this as Windows OS API telemetry.

Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host writing setpoint values to Open Platform Communications (OPC) Data Access (DA)/Unified Architecture (UA) tags or historian writable tags without being the recognized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) control application, with values falling outside the normal operating range. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Open Platform Communications (OPC) client process on an Industrial Control System (ICS) Windows host calling BrowseNamespace or GetProperties to enumerate the full tag tree, from a process not associated with a recognized Human-Machine Interface (HMI) or historian tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an Industrial Control System (ICS) protocol write specifically targeting alarm threshold/deadband configuration registers from a source not in the approved engineering list, where the new value widens the alarm deadband or shifts the trip point beyond the safe operating envelope, without operator acknowledgment. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a control/command message arriving at a field device from a source not in the approved control server list, where the command targets safety-critical output points and does not correspond to any scheduled or operator-acknowledged process action. Documented precedent: Industroyer2 connected directly to specific International Electrotechnical Commission (IEC)-104 RTUs and toggled hardcoded Information Object Addresses (IOAs) to OFF using command type 46, targeting circuit breaker outputs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an abrupt cessation of expected Industrial Control System (ICS) protocol traffic between a Supervisory Control and Data Acquisition (SCADA)/control server and a field device, without a corresponding device alarm or scheduled maintenance event, while the device remains reachable for at least some traffic types. This technique-level analytic synthesizes Command Message blocking (T1691.001) and Reporting Message blocking (T1691.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies device_ip offline alarm coinciding with switch port admin-down syslog for that port, distinguishing deliberate Ethernet blocking from physical disconnection. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring cross-correlates a field device's reported telemetry against an independent secondary measurement, identifying cases where the reported value diverges from the independent reading while the device's network-layer identity shows a MAC mismatch against its enrolled hardware address. Spoofed reporting messages are, by definition, designed to look protocol-valid. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a field device ceasing to send expected unsolicited reports or periodic status updates without a corresponding device alarm or maintenance event, while the device remains reachable via direct polling. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies field device access (Industrial Control System (ICS) protocol sessions, management interface authentication) using credentials or authentication tokens associated with a legitimate engineering account, but from a source Internet Protocol (IP) address or Media Access Control (MAC) address not enrolled as an authorized engineering workstation, where the authenticated session subsequently performs write operations the credential owner has not acknowledged via change control. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies successful authentication to a field device using credentials matching documented vendor-default values, from a source not in the approved access list. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies successful authentication to an Industrial Control System (ICS) device or application using credentials that are either documented vendor defaults (T1694.001) or extracted from configuration files/firmware where stored in cleartext (T1694.002), from a source not in the approved access list. This technique-level analytic unifies both sub-techniques. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies an Industrial Control System (ICS) embedded device executing a sequence of operations inconsistent with its programmed logic, correlating temporally with an operator interaction on an engineering terminal connected to the device. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies an embedded field device initiating outbound connections on a commonly-used port to a destination outside the device's documented operational communication profile, which for most embedded Industrial Control System (ICS) devices normally should not include arbitrary outbound internet connectivity under the approved communications architecture. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies Industrial Control System (ICS) field device IPs receiving inbound connections from internet-sourced IP addresses on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Near-real-time connection monitoring identifies an embedded field device or gateway initiating outbound connections on standard application-layer protocol ports to destinations outside the expected Industrial Control System (ICS) communication baseline. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. This analytic is implementable from session/flow metadata (endpoints, ports, protocol/service, timing, bytes); it does not require or claim packet-payload visibility.

Near-real-time connection monitoring identifies connections to Industrial Control System (ICS) field device management ports from Internet Protocol (IP) addresses routed through external remote access infrastructure rather than from within the expected ICS network segments. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows. This analytic is implementable from session/flow metadata (endpoints, ports, protocol/service, timing, bytes); it does not require or claim packet-payload visibility.

Real-time monitoring identifies Industrial Control System (ICS) protocol traffic originating from one field device Internet Protocol (IP) address to another field device, a pattern not consistent with the documented device-to-supervisory communication topology. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies rapid sequential Industrial Control System (ICS) protocol connection attempts to the same field device Internet Protocol (IP) address across different protocol ports from a single source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.