Restrict the execution of code to a virtual environment on or in-transit to an endpoint system.

Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic. Perform inline allow/denylisting of network messages based on the application layer (OSI Layer 7) protocol, especially for automation protocols. Application allowlists are beneficial when there are well-defined communication sequences, types, rates, or patterns needed during expected system operations. Application denylists may be needed if all acceptable communication sequences cannot be defined, but instead a set of known malicious uses can be denied (e.g., excessive communication attempts, shutdown messages, invalid commands). Devices performing these functions are often referred to as deep-packet inspection (DPI) firewalls, context-aware firewalls, or firewalls blocking specific automation/SCADA protocol aware firewalls.^[1]

References

1. Centre for the Protection of National Infrastructure 2005, February FIREWALL DEPLOYMENT FOR SCADA AND PROCESS CONTROL NETWORKS Retrieved. 2020/09/17

Restrict use of certain websites, block downloads/attachments, block Javascript, restrict browser extensions, etc.

Devices and programs designed to interact with control system parameters should validate the format and content of all user inputs and actions to ensure the values are within intended operational ranges. These values should be evaluated and further enforced through the program logic running on the field controller. If a problematic or invalid input is identified, the programs should either utilize a predetermined safe value or enter a known safe state, while also logging or alerting on the event.^[1]

References

1. PLC Security, Top 20 Community. (2021, June 15). Secure PLC Coding Practices: Top 20 version 1.0. Retrieved March 22, 2023.

Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Restrict network access to only required systems and services. In addition, prevent systems from other networks or business functions (e.g., enterprise) from accessing critical process control systems. For example, in IEC 62443, systems within the same secure level should be grouped into a zone, and access to that zone is restricted by a conduit, or mechanism to restrict data flows between zones by segmenting the network.^[1],[2]

References

1. IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25
2. IEC 2013, August Industrial communication networks - Network and system security - Part 3-3: System security requirements and security levels Retrieved. 2020/09/25

Prevent abuse of library loading mechanisms in the operating system and software to load untrusted code by configuring appropriate library loading mechanisms and investigating potential vulnerable software.

Configure Active Directory to prevent use of certain techniques; use security identifier (SID) Filtering, etc.

Use intrusion detection signatures to block traffic at network boundaries. In industrial control environments, network intrusion prevention should be configured so it will not disrupt protocols and communications responsible for real-time functions related to control or safety.

Restrict the ability to modify certain hives or keys in the Windows Registry.

Data Loss Prevention (DLP) technologies can be used to help identify adversarial attempts to exfiltrate operational information, such as engineering plans, trade secrets, recipes, intellectual property, or process telemetry. DLP functionality may be built into other security products such as firewalls or standalone suites running on the network and host-based agents. DLP may be configured to prevent the transfer of information through corporate resources such as email, web, and physical media such as USB for host-based solutions.

Access Management technologies can be used to enforce authorization polices and decisions, especially when existing field devices do not provide sufficient capabilities to support user identification and authentication.^[1] These technologies typically utilize an in-line network device or gateway system to prevent access to unauthenticated users, while also integrating with an authentication service to first verify user credentials.^[2]

References

1. McCarthy, J et al. 2018, July NIST SP 1800-2 Identity and Access Management for Electric Utilities Retrieved. 2020/09/17
2. Centre for the Protection of National Infrastructure 2010, November Configuring and Managing Remote Access for Industrial Control Systems Retrieved. 2020/09/25

This type of attack technique cannot be easily mitigated with preventative controls since it is based on the abuse of system features.

Use capabilities to detect and block conditions that may lead to or be indicative of a software exploit occurring.

Prevent access to file shares, remote access to systems, unnecessary services. Mechanisms to limit access may include use of network concentrators, RDP gateways, etc.

Block execution of code on a system through application control, and/or script blocking.

Configure hosts and devices to use static network configurations when possible, protocols that require dynamic discovery/addressing (e.g., ARP, DHCP, DNS) can be used to manipulate network message forwarding and enable various AiTM attacks. This mitigation may not always be usable due to limited device features or challenges introduced with different network configurations.

Set and enforce secure password policies for accounts.

Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.

Require user authentication before allowing access to data or accepting commands to a device. While strong multi-factor authentication is preferable, it is not always feasible within ICS environments. Performing strong user authentication also requires additional security controls and processes which are often the target of related adversarial techniques (e.g., Valid Accounts, Default Credentials). Therefore, associated ATT&CK mitigations should be considered in addition to this, including Multi-factor Authentication, Account Use Policies, Password Policies, User Account Management, Privileged Account Management, and User Account Control.

Break and inspect SSL/TLS sessions to look at encrypted web traffic for adversary activity.

Enforce binary and application integrity with digital signature verification to prevent untrusted code from executing.

Require the authentication of devices and software processes where appropriate. Devices that connect remotely to other systems should require strong authentication to prevent spoofing of communications. Furthermore, software processes should also require authentication when accessing APIs.

Utilize strong cryptographic techniques and protocols to prevent eavesdropping on network communications.

Configure features related to account use like login attempt lockouts, specific login times, etc.

This mitigation describes any guidance or training given to developers of applications to avoid introducing security weaknesses that an adversary may be able to take advantage of.

Use secure methods to boot a system and verify the integrity of the operating system and loading mechanisms.

Utilize a layered protection design based on physical or mechanical protection systems to prevent damage to property, equipment, human safety, or the environment. Examples include interlocks, rupture disk, release values, etc.^[1]

References

1. A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004 APPLYING THE LATEST STANDARD FOR FUNCTIONAL SAFETY IEC 61511 Retrieved. 2020/09/17

Perform regular software updates to mitigate exploitation risk. Software updates may need to be scheduled around operational down times.

Utilize watchdog timers to ensure devices can quickly detect whether a system is unresponsive.

Deploy mechanisms to protect the confidentiality of information related to operational processes, facility locations, device configurations, programs, or databases that may have information that can be used to infer organizational trade-secrets, recipes, and other intellectual property (IP).

Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.

Block users or groups from installing or using unapproved hardware on systems, including USB devices.

Protect sensitive data-at-rest with strong encryption.

Network allowlists can be implemented through either host-based files or system hosts files to specify what connections (e.g., IP address, MAC address, port, protocol) can be made from a device. Allowlist techniques that operate at the application layer (e.g., DNP3, Modbus, HTTP) are addressed in Filter Network Traffic mitigation.

Implement a supply chain management program, including policies and procedures to ensure all devices and components originate from a trusted supplier and are tested to verify their integrity.

Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise. Maintain and exercise incident response plans^[1], including the management of 'gold-copy' back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.

References

1. Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17

Have alternative methods to support communication requirements during communication failures and data integrity attacks.^[1],[2]

References

1. National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17
2. Defense Advanced Research Projects Agency National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 Rapid Attack Detection, Isolation and Characterization Systems (RADICS) Retrieved. 2020/09/17

Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses. Perform periodic integrity checks of the device to validate the correctness of the firmware, software, programs, and configurations. Integrity checks, which typically include cryptographic hashes or digital signatures, should be compared to those obtained at known valid states, especially after events like device reboots, program downloads, or program restarts.

When communicating over an untrusted network, utilize secure network protocols that both authenticate the message sender and can verify its integrity. This can be done either through message authentication codes (MACs) or digital signatures, to detect spoofed network messages and unauthorized connections.

Remove or deny access to unnecessary and potentially vulnerable software to prevent abuse by adversaries.

A threat intelligence program helps an organization generate their own threat intelligence information and track trends to inform defensive priorities to mitigate risk.

Utilize Safety Instrumented Systems (SIS) to provide an additional layer of protection to hazard scenarios that may cause property damage. A SIS will typically include sensors, logic solvers, and a final control element that can be used to automatically respond to an hazardous condition^[1] . Ensure that all SISs are segmented from operational networks to prevent them from being targeted by additional adversarial behavior.

References

1. A G Foord, W G Gulland, C R Howard, T Kellacher, W H Smith 2004 APPLYING THE LATEST STANDARD FOR FUNCTIONAL SAFETY IEC 61511 Retrieved. 2020/09/17

Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.

Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator. Within industrial control environments assets such as low-level controllers, workstations, and HMIs have real-time operational control and safety requirements which may restrict the use of multi-factor.

Vulnerability scanning is used to find potentially exploitable software vulnerabilities to remediate them.

The device or system should restrict read, manipulate, or execute privileges to only authenticated users who require access based on approved security policies. Role-based Access Control (RBAC) schemes can help reduce the overhead of assigning permissions to the large number of devices within an ICS. For example, IEC 62351 provides examples of roles used to support common system operations within the electric power sector^[1], while IEEE 1686 defines standard permissions for users of IEDs.^[2]

References

1. International Electrotechnical Commission 2020, July 17 IEC 62351 - Power systems management and associated information exchange - Data and communications security Retrieved. 2020/09/17
2. Institute of Electrical and Electronics Engineers 2014, January 1686-2013 - IEEE Standard for Intelligent Electronic Devices Cyber Security Capabilities Retrieved. 2020/09/17

Manage the creation, modification, use, and permissions associated to user accounts.

Redundancy could be provided for both critical ICS devices and services, such as back-up devices or hot-standbys.

Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.

Implement configuration changes to software (other than the operating system) to mitigate security risks associated with how the software operates.

Use signatures or heuristics to detect malicious software. Within industrial control environments, antivirus/antimalware installations should be limited to assets that are not involved in critical or real-time operations. To minimize the impact to system availability, all products should first be validated within a representative test environment before deployment to production systems.^[1]

References

1. NCCIC 2018, August 2 Recommended Practice: Updating Antivirus in an Industrial Control System Retrieved. 2020/09/17

Wireless signals frequently propagate outside of organizational boundaries, which provide opportunities for adversaries to monitor or gain unauthorized access to the wireless network.^[1] To minimize this threat, organizations should implement measures to detect, understand, and reduce unnecessary RF propagation.^[2]

References

1. CISA 2010, March Securing Wireless Networks Retrieved. 2020/09/17
2. DHS National Urban Security Technology Laboratory 2019, April Radio Frequency Detection, Spectrum Analysis, and Direction Finding Equipment Retrieved. 2020/09/17

Monitor Windows Security Event ID 4663 on explicitly audited ICS data paths and correlate repeated ReadData/ListDirectory access across multiple sensitive files or directories by an account/process outside the approved engineering, backup, or application baseline. This requires Object Access auditing and SACLs on the monitored paths; Sysmon does not provide generic file-read telemetry. Alert when the bulk-read pattern occurs outside an approved backup/export window or is followed by staging, compression, or network transfer.

Real-time monitoring identifies a remote service connection between two Industrial Control System (ICS) network hosts that does not match the documented, approved communication matrix, where the destination host subsequently exhibits process execution or file access inconsistent with normal automated/scheduled inter-host communication. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies an unsigned or unexpected process calling Windows hooking Application Programming Interfaces (APIs) (SetWindowsHookEx, SetWinEventHook) targeting an Industrial Control System (ICS) engineering or Human-Machine Interface (HMI) process, immediately followed by that target process loading a Dynamic Link Library (DLL) not present in the vendor's signed module baseline. Confirmed in the wild: Stuxnet replaced Siemens' s7otbxdx.dll on engineering workstations to intercept and falsify Programmable Logic Controller (PLC) read/write calls between WinCC/STEP7 and the controller. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies wireless controller management log entries showing Service Set Identifier (SSID) or Media Access Control (MAC) address filter configuration changes for the Industrial Control System (ICS) wireless network from an account not in the authorized wireless admins. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies successful authentication to Windows-hosted Industrial Control System (ICS) applications using credentials matching known default or hardcoded vendor passwords. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies the absence of expected command-message delivery confirmation -- a Supervisory Control and Data Acquisition (SCADA)-issued command that does not produce the expected corresponding state-change response within the normal response latency window, while the device remains reachable for other traffic. Documented in the 2015 Ukraine attack, where Sandworm used malicious firmware to render serial-to-Ethernet converters inoperable. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies access to Industrial Control System (ICS) documentation repositories by an account or session context not associated with documented engineering roles, immediately followed by bulk file access or archive creation. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time network monitoring identifies a source issuing read-only Industrial Control System (ICS) protocol requests to multiple field devices at a polling rate exceeding the legitimate Supervisory Control and Data Acquisition (SCADA) baseline, from a source not in the approved control server allowlist. Because the action is read-only, source-identity and rate deviation are the only available distinguishing signals. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

No standard detection method currently exists for this technique.

Real-time monitoring identifies an Industrial Control System (ICS) protocol write to a controller's task/organization-block configuration from a source not in the approved engineering workstation list, correlated against post-modification cycle timing deviation. Documented precedent: Stuxnet infected Siemens OB1 (main execution cycle block) so its malicious payload ran every cycle, and infected OB35 (watchdog/interrupt block) to suppress error reporting. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) online-edit command sequence (incremental program modification while the device remains in RUN mode) from a source not in the approved engineering workstation list, outside a scheduled change-control window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a previously unseen wireless device identity joining or authenticating to an ICS wireless segment—such as Wi-Fi/802.1X, WirelessHART, ISA100.11a, or a vendor radio mesh—when its MAC/EUI, certificate, or device identifier is absent from the approved wireless asset inventory. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a trusted, signed Windows system binary executing with command-line arguments inconsistent with its documented administrative purpose -- specifically arguments indicating payload decoding, remote content execution, or script invocation -- on an Industrial Control System (ICS) host. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a Windows process generating Industrial Control System (ICS) command messages to field device tags representing physical outputs, from a process that is not the recognized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) control application, targeting safety-critical output tags. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a process loading a packet capture driver or executing a known capture utility on an Industrial Control System (ICS) host's network interface, from a process or account not associated with documented network analysis responsibilities. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

No standard detection method currently exists for this technique.

Real-time monitoring identifies a field device loading a modified autorun image (boot read-only memory, bootloader firmware) detected by a discrepancy between the device's declared firmware hash and the authorized firmware inventory hash, with post-reboot device behavior diverging from expected (unexpected protocols active, unanticipated network connections). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Monitor command-line arguments for script execution and subsequent behavior. Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script. Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used.
Monitor log files for process execution through command-line and scripting activities. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools. Also monitor for loading of modules associated with specific languages.
Monitor contextual data about a running process, which may include information such as environment variables, image name, user/owner, or other information that may reveal abuse of system features.
Monitor for events associated with scripting execution, such as the loading of modules associated with scripting languages (e.g., JScript.dll, vbscript.dll).
Monitor for any attempts to enable scripts running on a system would be considered suspicious. If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious. Scripts should be captured from the file system when possible to determine their actions and intent.

Real-time monitoring identifies execution of network discovery tools (nmap, PLCScan, redpoint NSE scripts) or Industrial Control System (ICS)-specific scanners from an Industrial Control System (ICS) Windows host, from a process not associated with a recognized network management or engineering tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host injecting spoofed reporting messages into the Supervisory Control and Data Acquisition (SCADA) data path -- Open Platform Communications Unified Architecture (OPC UA) data change notifications with fabricated values, or historian tag writes that override device-sourced values -- from a process that is not the recognized data acquisition process. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a browser process on an Industrial Control System (ICS) workstation spawning an unexpected child process immediately following navigation to an external website, particularly a vendor support or software-download site. Documented Havex precedent: adversaries compromised legitimate ICS vendor websites to serve trojanized software downloads. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to alarm threshold Object Identifiers (OIDs) on Industrial Control System (ICS) network devices or process monitoring systems from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a loss of communication with serially-connected field devices correlated with a configuration change event on the serial-to-Ethernet gateway. Documented in the 2015 Ukraine attack, where Sandworm used malicious firmware to render serial-to-Ethernet converters inoperable. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Industrial Control System (ICS) master-role command traffic originating from a source not in the approved control server inventory, directed at multiple field devices in a pattern consistent with control-server behavior. Documented in Maroochy Water Services (falsified PDS/station addresses to impersonate the master) and the 2017 Dallas Siren incident (rogue radio transmitter to 156 sirens). OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.

No standard detection method currently exists for this technique.

Real-time monitoring identifies iptables/nftables rules on Industrial Control System (ICS) Linux gateways that selectively drop ICS reporting message traffic based on content while allowing command traffic to pass. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) protocol session reading back the user program from a field device to a source not in the approved engineering workstation list, where the session byte count is consistent with a substantial portion of the device's program memory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an Industrial Control System (ICS) protocol session adding new program blocks or routines to an existing controller program without replacing existing logic, from a source not in the approved engineering workstation list, correlated against the device's program inventory showing a size increase without a corresponding planned update. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a network-accessible service process (lsass.exe, a vendor remote management service) spawning an unexpected child process or exhibiting cross-process memory access patterns immediately following inbound connection from an unusual source. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a network infrastructure configuration change that results in a communication gap between previously-connected Industrial Control System (ICS) zones, from a source not in the approved network administration list. This technique-level analytic synthesizes Serial COM (T1695.001), Ethernet (T1695.002), and Wi-Fi (T1695.003). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a field device entering firmware update mode and receiving a large data transfer on its firmware-capable protocol port from a source not in the approved engineering workstation list, followed by a device reboot, with post-reboot firmware hash not matching the authorized inventory. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) protocol session that systematically enumerates a device's full tag/object namespace from a source not in the approved control server list, where the enumeration pattern covers the complete address/object space rather than the sparse, fixed tag set legitimate Supervisory Control and Data Acquisition (SCADA) polling queries. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an Industrial Control System (ICS) protocol write to a parameter/setpoint register where the written value falls outside the documented safe operating range, or where the write originates from a source not in the approved write-source list, correlated with subsequent historian tag drift. Documented precedent: FrostyGoop directly modified Modbus holding register values on ENCO heating controllers in Lviv, Ukraine, causing a two-day remediation outage. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies execution of port scanning utilities (nmap, masscan) with arguments targeting Industrial Control System (ICS) protocol port ranges on an ICS Windows host. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an audit log clearing event or deletion/truncation of an Industrial Control System (ICS) vendor application log file, immediately preceded by other suspicious activity on the same host within a short lookback window. Documented in the CaddyWiper deployment alongside Industroyer2, explicitly intended to destroy evidence and slow forensic recovery. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an email client process on an Industrial Control System (ICS) Linux workstation spawning a child process inconsistent with normal email handling. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies an Industrial Control System (ICS) protocol message arriving at a device from a source whose identity is not in the approved communication baseline for that destination, where the message is structurally valid but originates outside the documented set of legitimate communicators. This technique-level analytic synthesizes Command Message (T1692.001) and Reporting Message (T1692.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

No standard detection method currently exists for this technique.

Real-time monitoring identifies execution of screenshot utilities (scrot, import, xwd) on an Industrial Control System (ICS) Linux Human-Machine Interface (HMI), from a User Identifier (UID) that does not normally perform display operations. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies Internet Group Management Protocol (IGMP) membership reports for Industrial Control System (ICS) multicast groups from a source not in the approved device inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

No standard detection method currently exists for this technique.

Configured Windows object-access monitoring identifies a write to a Siemens project file by a process that is not the Siemens Totally Integrated Automation (TIA) Portal or Step7 engineering software, or by the legitimate Siemens tool immediately after loading a project from an untrusted path. Directly documented as a Stuxnet mechanism. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Collection requirement: use Windows Security Event ID 4663 with Object Access auditing and SACLs on approved project repositories; Sysmon FileCreate events can corroborate writes/overwrites but do not report generic file-open/read activity.

Real-time monitoring identifies a service control command targeting a critical Industrial Control System (ICS) services such as Open Platform Communications (OPC) server, historian, Supervisory Control and Data Acquisition (SCADA) polling from an account not in the authorized service administration role, without a preceding change-control ticket, immediately followed by the service transitioning to Stopped state. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Configured Windows object-access monitoring identifies a write to an Industrial Control System (ICS) engineering project file by a process that is not the recognized vendor engineering software, or by the vendor engineering software immediately after loading a project file from an untrusted source. Documented mechanism in Havex (trojanized vendor software/installers distributed via compromised vendor websites). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Collection requirement: use Windows Security Event ID 4663 with Object Access auditing and SACLs on approved project repositories; Sysmon FileCreate events can corroborate writes/overwrites but do not report generic file-open/read activity.

On Windows and Unix systems monitor executed commands and arguments that may use shell commands for execution. Shells may be common on administrator, developer, or power user systems depending on job function.

On network device and embedded system CLIs consider reviewing command history if unauthorized or suspicious commands were used to modify device configuration.
Monitor logs from installed applications (e.g., historian logs) for unexpected commands or abuse of system features.
Monitor for processes spawning from known command shell applications (e.g., PowerShell, Bash). Benign activity will need to be allow-listed. This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools.

Real-time network monitoring identifies a source issuing write commands to the same Input/Output (I/O) point or register address at a rate significantly exceeding the device's configured scan cycle. The write rate itself is the signature, with source identity retained as corroborating context; treat the rate deviation as suspicious only after excluding tuning, commissioning, failover, and fault-recovery activity. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) protocol write to output register addresses on a field device from a source not in the approved write-source list, correlated with a discrepancy between the value reported by the Input/Output (I/O) image and an independent measurement of the actual physical output state. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. The independent measurement is process-state telemetry, not network-flow evidence; implementation requires a separately trusted sensor/historian/measurement path with time alignment and an engineering-defined tolerance.

Real-time monitoring identifies an Industrial Control System (ICS) protocol mode-change command targeting a field device from a source not in the approved engineering workstation list, where the transition is not immediately followed by a corresponding operator acknowledgment. Documented in Triton (the Tricon controller had to be placed in PROGRAM mode before the attack could inject its payload). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a process or scheduled task whose displayed name matches a known Industrial Control System (ICS) vendor application but whose on-disk binary hash or file path does not match the vendor-signed baseline. The mismatch -- name says one thing, binary integrity says another -- is the defining signal. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies execution of network enumeration commands (netstat, arp -a, Get-NetTCPConnection) on an Industrial Control System (ICS) host from an account not associated with documented network administration, where multiple such commands execute in sequence within a short window. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

No standard detection method currently exists for this technique.

No standard detection method currently exists for this technique.

Real-time monitoring identifies inbound connections to Industrial Control System (ICS) Windows application servers from internet-routed Internet Protocol (IP) addresses. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies a firmware write command targeting a specific Input/Output (I/O) module slot address within a controller chassis from a source not in the approved engineering workstation list, distinguishing module-level firmware modification from main-processor firmware updates by its slot-addressed targeting. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) protocol write to an existing program block from a source not in the approved engineering workstation list, outside a scheduled change-control window, correlated against post-modification program hash comparison and measurable change in controller Input/Output (I/O) behavior. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a vendor-distributed software update package that, upon execution, exhibits behavior inconsistent with the vendor's documented installation profile: spawning unexpected child processes, writing files outside the vendor's standard manifest, or loading unsigned Dynamic Link Libraries (DLLs). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies Industrial Control System (ICS) protocol requests specifically targeting mode/status registers from a source not in the approved control server or engineering workstation list, where the request pattern is narrowly focused on mode/state data rather than broader process value polling. Directly documented in the Triton attack chain's 'Get Control Program Status' request. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

No standard detection method currently exists for this technique.

No standard detection method currently exists for this technique.

Real-time monitoring identifies authentication to an external remote access gateway using credentials associated with Industrial Control System (ICS)-role accounts, from a source geolocation or Autonomous System Number (ASN) inconsistent with the account's established usage pattern, immediately followed by that session establishing connectivity into the ICS network zone. Documented in VPNFilter, which specifically targeted routers and network edge devices. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a device establishing its first network connection to Industrial Control System (ICS) application servers from an Internet Protocol (IP) address or Media Access Control (MAC) address not previously seen in the environment, immediately following a new device association event on the network. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a file written to an Industrial Control System (ICS) host from a remote network share, where the file has an executable or script extension, immediately followed by execution of that file from the same path. Documented in the PIPEDREAM toolkit's modular design, where components transfer files to compromised Programmable Logic Controllers (PLCs) and engineering workstations. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an Industrial Control System (ICS) protocol message sequence placing a field device into firmware-update mode from a source not in the approved engineering workstation list, correlated with the device's alarm telemetry going silent within a short grace period without acknowledgment. Documented precedent: Industroyer exploited CVE-2015-5374 by sending a crafted packet that initiated an incomplete firmware update sequence on Siemens Protection Technology (SIPROTEC) relays. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) host or server establishing outbound connections on a commonly-allowed port (e.g., 443, 80, 8080, 53, etc.) to a destination not in the approved vendor/business domain list, where that host's documented network role does not require external connectivity. Documented real-world use: Sandworm's 2015 Ukraine power grid attack used port 443 for Command and Control (C2) communications. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. SNI and certificate attributes are TLS/session metadata; do not treat them as decrypted payload content. Encrypted application content requires a separate inspection point.

Real-time monitoring identifies a Universal Serial Bus (USB) storage device insertion event on an Industrial Control System (ICS) engineering or Human-Machine Interface (HMI) workstation where the device's hardware identifier (ID) is not in the authorized USB allowlist, immediately followed by process execution from the removable drive's path. Documented as the primary infection vector for Stuxnet, which specifically targeted air-gapped Siemens engineering environments via infected USB drives. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host making direct native Operating System (OS) Application Programming Interface (API) calls that bypass the normal ICS vendor Software Development Kit (SDK) abstraction layer -- direct CreateFile calls against raw device paths, DeviceIoControl calls to ICS hardware driver handles -- from a process not a recognized vendor application. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an Industrial Control System (ICS) Windows host simultaneously holding connections to both the field device subnet and an unexpected external or inter-zone destination, combined with proxy-capable process spawning and ICS vendor application logs showing endpoint or certificate changes. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies field device access using credentials matching hardcoded values extracted from Industrial Control System (ICS) vendor firmware or configuration files, from a source with no legitimate operational role. Documented in TriStation 1131 v4.9.0 and earlier, which contained undocumented power-user accounts with hardcoded credentials. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies Industrial Control System (ICS) protocol commands succeeding against protected device functions from a source or session context that the device's documented access control model should reject, indicating exploitation of a vulnerability to bypass the device's privilege model. Documented as the core mechanism of the Triton attack, which exploited a zero-day in Triconex firmware while in PROGRAM mode. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an Industrial Control System (ICS) protocol session consistent with a program download to a field device from a source not in the approved engineering workstation list, correlated with a device mode-change alarm transitioning to PROGRAM/STOP immediately preceding the transfer. Documented in Stuxnet (code/data block download to alter programmable logic controller behavior) and Triton (TriStation protocol program download to the Triconex Safety Instrumented System). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies indirect evidence of passive RF capture on Industrial Control System (ICS) wireless frequencies -- an unassociated device's RF signature detected without a completed association sequence, or a known device's Media Access Control (MAC) address detected from a location/signal strength inconsistent with its registered installation point. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a single Industrial Control System (ICS) protocol session reading the complete Input/Output (I/O) image from a field device, rather than the sparse, fixed tag subset that legitimate Supervisory Control and Data Acquisition (SCADA) polling queries, from a source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies iptables/nftables rule changes on Industrial Control System (ICS) Linux gateways that selectively block one ICS communication traffic type. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

No standard detection method currently exists for this technique.

No standard detection method currently exists for this technique.

Real-time network monitoring identifies a sustained spike in malformed or high-volume Industrial Control System (ICS) protocol traffic directed at a single field device from a source not in the approved control server list, immediately followed by that device dropping out of the supervisory poll cycle. Documented precedent: Sandworm's Industroyer malware sent a crafted 18-byte proprietary User Datagram Protocol (UDP) packet to port 50000 on Siemens Protection Technology (SIPROTEC) relays (CVE-2015-5374), causing the device to hang and require a manual reboot. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.

Real-time monitoring identifies Domain Name System (DNS) queries from Industrial Control System (ICS) host Internet Protocol (IP) addresses to external resolvers for domains not associated with any approved ICS vendor, particularly domains exhibiting Domain Generation Algorithm (DGA)-like patterns. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies Industrial Control System (ICS) protocol commands changing device-level credentials or access codes from a source not in the approved security administration list, where the device subsequently rejects connections from legitimate control system components. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

No standard detection method currently exists for this technique.

Real-time monitoring identifies a user-invoked action on an Industrial Control System (ICS) workstation immediately followed by a process execution chain inconsistent with normal ICS operations -- the user-driven trigger plus the resulting anomalous execution chain together distinguish this from generic malware execution. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies an interactive desktop session Remote Desktop Protocol (RDP), Virtual Network Computing (VNC), or vendor remote console to an Human-Machine Interface (HMI) or engineering station from a source Internet Protocol (IP) addresses outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, or from an account not in the approved operator/engineer list, where the session subsequently interacts with Industrial Control System (ICS) control elements. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies an internet-facing Industrial Control System (ICS) application server, web Human-Machine Interface (HMI), historian web interface, vendor remote access portal) process spawning an unexpected child process immediately following an inbound web request containing exploit-pattern content. Documented across multiple incidents involving internet-exposed ICS web interfaces. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Analyst implementation must limit predicates to fields actually retained by the web server/WAF (for example URI/path/query/header/status/source); request-body or payload signatures require WAF/DPI or request-body logging and must not be inferred from a basic access log.

Real-time monitoring identifies an Industrial Control System (ICS)-role account authenticating via interactive or remote logon from a workstation not in the approved host inventory, or outside the account's established usage pattern, immediately followed within a short window by that session connecting to the field device network or ICS application. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a Windows network-adapter disable or administrative interface-down event on an ICS gateway or protocol-converter host outside the approved network-maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time network monitoring identifies a source issuing systematic, sequential Industrial Control System (ICS) protocol reads sweeping the full register/address range across multiple field devices within a short time window, from a source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an Industrial Control System (ICS) protocol session reading back the complete program, configuration, and data block set from a field device in a single session from a source not in the approved engineering workstation list, distinguished from a partial Program Upload by the comprehensiveness of the read. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an unrecognized process on an ICS Linux host loading an ICS/vendor shared library that is normally restricted to approved control or engineering applications. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Periodic or event-triggered integrity verification identifies a discrepancy between a field device's self-reported diagnostic state and an independently verified hardware/firmware fingerprint, indicating the device's reporting layer has been compromised. MITRE explicitly notes firmware/module rootkits 'can also be developed for the Input/Output (I/O) that is attached to an asset.'. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Monitoring reality: this is an integrity/posture analytic, not a universal streaming field-device event; collection cadence depends on the vendor integrity interface, asset-management system, or acquisition workflow.

Real-time monitoring identifies a Linux process with both a listening socket on an Industrial Control System (ICS) protocol port and an outbound connection to a non-ICS destination, or iptables DNAT/REDIRECT rules added on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring of the alarm and process historian layer identifies an alarm status transitioning to suppressed, shelved, disabled, or acknowledged without a corresponding operator action recorded within a grace period, correlated with Industrial Control System (ICS) protocol write traffic to alarm configuration or threshold registers arriving in the same window from a source not in the approved engineering list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies remote Windows system-information queries using WMI/CIM, WinRM, PowerShell remoting, or equivalent management tooling where the command names a non-local target and the account/source is outside the approved management baseline. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies successful authentication to an Industrial Control System (ICS) application such as a Human-Machine Interface (HMI), historian, Supervisory Control and Data Acquisition (SCADA) server using credentials matching known default vendor passwords, from a logon source not associated with any authorized user. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies new Internet Group Management Protocol (IGMP) joins or broadcast traffic spikes on Industrial Control System (ICS) Virtual Local Area Networks (VLANs) from a source not in the approved device inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a process performing rapid, bulk deletion or overwrite of files across multiple Industrial Control System (ICS)-relevant directories within a short time window, by a process not associated with documented data retention management, correlated with a system crash shortly after. Documented in CaddyWiper, deployed via GPO alongside Industroyer2. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies malformed or out-of-spec ICS protocol exchanges targeting an embedded device from a source outside the approved communication baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies the full firmware modification chain: a device entering firmware-update mode, receiving a large data transfer on a firmware-capable protocol port from a source not in the approved engineering workstation list, rebooting, and reporting a post-reboot firmware hash that does not match the authorized inventory. This technique-level analytic synthesizes System Firmware (T1693.001) and Module Firmware (T1693.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) protocol restart/reset command directed at a field device from a source not in the approved engineering workstation list, particularly where multiple devices receive restart commands within a short window. Documented precedent: Industroyer exploited CVE-2015-5374 via a crafted 18-byte User Datagram Protocol (UDP) packet to port 50000 on Siemens SIPROTEC relays. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

A VPN server is a device that is used to establish a secure network tunnel between itself and other remote VPN devices, including field VPNs. VPN servers can be used to establish a secure connection with a single remote device, or to securely bridge all traffic between two separate networks together by encapsulating all data between those networks. VPN servers typically support remote network services that are used by field VPNs to initiate the establishment of the secure VPN tunnel between the field device and server.

Jump hosts are devices used to support remote management sessions into ICS networks or devices. The system is used to access the ICS environment securely from external networks, such as the corporate network. The user must first remote into the jump host before they can access ICS devices. The jump host may be a customized Windows server using common remote access protocols (e.g., RDP) or a dedicated access management device. The jump host typically performs various security functions to ensure the authenticity of remote sessions, including authentication, enforcing access controls/permissions, and auditing all access attempts.

A Remote Terminal Unit (RTU) is a device that typically resides between field devices (e.g., PLCs, IEDs) and control/SCADA servers and supports various communication interfacing and data aggregation functions. RTUs are typically responsible for forwarding commands from the control server and the collection of telemetry, events, and alerts from the field devices. An RTU can be implemented as a dedicated embedded device, as software platform that runs on a hardened/ruggedized computer, or using a custom application program on a PLC.

Field I/O are devices that communicate with a controller or data aggregator to either send input data or receive output data. Input data may include readings about a given environment/device state from sensors, while output data may include data sent back to actuators for them to either undertake actions or change parameter values.^[1] These devices are frequently embedded devices running on lightweight embedded operating systems or RTOSes.

References

1. Keith Stouffer. (2015, May). Guide to Industrial Control Systems (ICS) Security. Retrieved March 28, 2018.

Human-Machine Interfaces (HMIs) are systems used by an operator to monitor the real-time status of an operational process and to perform necessary control functions, including the adjustment of device parameters. An HMI can take various forms, including a dedicated screen or control panel integrated with a specific device/controller, or a customizable software GUI application running on a standard operating system (e.g., MS Windows) that interfaces with a control/SCADA server. The HMI is critical to ensuring operators have sufficient visibility and control over the operational process.

A Programmable Automation Controller (PAC) is an embedded programmable control device. PACs are designed to enable automation applications across integrated software applications, peer controllers (e.g., PLC), Human Machine Interfaces, and other systems. PACs often include advanced features for process control, motion control, drive control, and vision applications. PACs are programmed using traditional process automation programming languages (IEC-61131) and sometimes languages such as C and C++ to support more advanced controls.

Data Gateway is a device that supports the communication and exchange of data between different systems, networks, or protocols within the ICS. Different types of data gateways are used to perform various functions, including:

• <u>Protocol Translation:</u> Enable communication to devices that support different or incompatible protocols by translating information from one protocol to another.
• <u>Media Converter:</u> Convert data across different Layer 1 and 2 network protocols / mediums, for example, converting from Serial to Ethernet.
• <u>Data Aggregation:</u> Collect and combine data from different devices into one consistent format and protocol interface.
• <u>Data Mirroring:</u> Create a real-time, exact copy of data streams from devices to a separate destination for redundancy, monitoring, or backup purposes.

Data gateways are often critical to the forwarding/transmission of critical control or monitoring data within the ICS. Further, these devices often have remote various network services that are used to communicate across different zones or networks.

These assets may focus on a single function listed below or combinations of these functions to best fit the industry use-case.

Safety controllers are typically a type of field device used to perform the safety critical function. Safety controllers often support the deployment of custom programs/logic, similar to a PLC, but can also be tailored for sector specific functions/applications. The safety controllers typically utilize redundant hardware and processors to ensure they operate reliably if a component fails.

An Intelligent Electronic Device (IED) is a type of specialized field device that is designed to perform specific operational functions, frequently for protection, monitoring, or control within the electric sector. IEDs are typically used to both acquire telemetry and execute tailored control algorithms/actions based on customizable parameters/settings. An IED is usually implemented as a dedicated embedded device and supports various network automation protocols to communicate with RTUs and Control Servers.

A Distributed Control System (DCS) Controller is a microprocessor unit that is used to manage automation processes. DCS Controllers are often found in plants (chemical, manufacturing, oil and gas, etc.) where large scale continuous automation processes are required. A DCS Controller typically operates as part of a larger networked system with other DCS Controllers where each DCS Controller manages an individual part of a continuous process. In addition to these other controllers, DCS Controllers operate along side multiple other system components including system software, operator stations, and other embedded field controllers. The distributed nature of DCS Controllers provides scalability, redundancy, and improved process reliability. DCS Controllers are programmed using traditional process automation programming languages (IEC-61131).

Application servers are used across many different sectors to host various diverse software applications necessary to supporting the ICS. Example functions can include data analytics and reporting, alarm management, and the management/coordination of different control servers. The application server typically runs on a modern server operating system (e.g., MS Windows Server).

A Programmable Logic Controller (PLC) is an embedded programmable control device. PLCs typically utilize a modular architecture with separate modules used to support its processing capabilities, communication mediums, and I/O interfaces. PLCs allow for the deployment of customized programs/logic to control or monitor an operational process. This logic is defined using industry specific programming languages, such as IEC 61131^[1], which define the set of tasks and program organizational units (POUs) included in the device’s programs. PLCs also typically have distinct operating modes (e.g., Remote, Run, Program, Stop) which are used to determine when the device can be programmed or whether it should execute the custom logic.

References

1. IEC 2013, February 20 IEC 61131-3:2013 Programmable controllers - Part 3: Programming languages Retrieved. 2019/10/22

A gateway that limits access between networks in accordance with local security policy.

In ICS networks, firewalls can exist in multiple locations in the network architecture and serve a variety of purposes. The first, and often the most important, is the firewall segmenting the ICS network from the business network. This firewall acts as the primary network boundary point that controls the ingress/egress of network traffic between the ICS and business networks. This firewall may also be a single device connected to multiple network segments, where the firewall defines individual zones for the different network segments and can control access to the zones and between the zones. This can limit the ability of an adversary to traverse a network.

A switch is a network device that connects endpoints (e.g., workstations, servers, HMIs, PLCs, etc.) so that they can communicate and share data and resources. Switches may operate at either Layer 2 or Layer 3 of the OSI Model and intelligently forward packets across the network based on the specified address (Media Access Control (MAC) address for Layer 2 and Internet Protocol (IP) address for Layer 3). Switches are typically used to define network segments and connect the devices within a particular level of the Purdue Model.

A computer that is a gateway between two networks at OSI layer 3 and that relays and directs data packets through that inter-network. The most common form of router operates on IP packets.^[1]

References

1. Internet Engineering Task Force. (2007, August). Internet Security Glossary, Version 2. Retrieved September 29, 2023.

Data historians, or historian, are systems used to collect and store data, including telemetry, events, alerts, and alarms about the operational process and supporting devices. The historian typically utilizes a database to store this data, and commonly provide tools and interfaces to support the analysis of the data. Data historians are often used to support various engineering or business analysis functions and therefore commonly needs access from the corporate network. Data historians often work in a hierarchical paradigm where lower/site level historians collect and store data which is then aggregated into a site/plant level historian. Therefore, data historians often have remote services that can be accessed externally from the ICS network. Many data historian vendors have designed their software to securely transfer data between the ICS and business networks instead of requiring business systems to access the data historian in the ICS network directly.

Control servers are typically a software platform that runs on a modern server operating system (e.g., MS Windows Server). The server typically uses one or more automation protocols (e.g., Modbus, DNP3) to communicate with the various low-level control devices such as Remote Terminal Units (RTUs) and Programmable Logic Controllers (PLCs). The control server also usually provides an interface/network service to connect with an HMI.

Workstations are devices used by human operators or engineers to perform various configuration, programming, maintenance, diagnostic, or operational tasks. Workstations typically utilize standard desktop or laptop hardware and operating systems (e.g., MS Windows), but run dedicated control system applications or diagnostic/management software to support interfacing with the control servers or field devices. Some workstations have a fixed location within the network architecture, while others are transient devices that are directly connected to various field devices to support local management activities.

The removal of a registry key within the Windows operating system.

Data Collection Measures:

• Windows Event Logs
• Event ID 4658 - Registry Key Handle Closed: Captures when a handle to a registry key is closed, which may indicate deletion.
• Event ID 4660 - Object Deleted: Logs when a registry key is deleted.
• Sysmon (System Monitor) for Windows
• Sysmon Event ID 12 - Registry Key Deleted: Logs when a registry key is removed.
• Sysmon Event ID 13 - Registry Value Deleted: Captures removal of specific registry values.
• Endpoint Detection and Response (EDR) Solutions
• Monitor registry deletions for suspicious behavior.

The initial establishment of a network session, where a system or process initiates a connection to a local or remote endpoint. This typically involves capturing socket information (source/destination IP, ports, protocol) and tracking session metadata. Monitoring these events helps detect lateral movement, exfiltration, and command-and-control (C2) activities.

Data Collection Measures:

• Windows:
• Event ID 5156 – Filtering Platform Connection - Logs network connections permitted by Windows Filtering Platform (WFP).
• Sysmon Event ID 3 – Network Connection Initiated - Captures process, source/destination IP, ports, and parent process.
• Linux/macOS:
• Netfilter (iptables), nftables logs - Tracks incoming and outgoing network connections.
• AuditD (connect syscall) - Logs TCP, UDP, and ICMP connections.
• Zeek (conn.log) - Captures protocol, duration, and bytes transferred.
• Cloud & Network Infrastructure:
• AWS VPC Flow Logs / Azure NSG Flow Logs - Logs IP traffic at the network level in cloud environments.
• Zeek (conn.log) or Suricata (network events) - Captures packet metadata for detection and correlation.
• Endpoint Detection & Response (EDR):
• Detect anomalous network activity such as new C2 connections or data exfiltration attempts.

To events where a file is opened or accessed, making its contents available to the requester. This includes reading, executing, or interacting with files by authorized or unauthorized entities. Examples include logging file access events (e.g., Windows Event ID 4663), monitoring file reads, and detecting unusual file access patterns. Examples:

• File Read Operations: A user opens a sensitive document (e.g., financial_report.xlsx) on a shared drive.
• File Execution: A script or executable file is accessed and executed (e.g., malware.exe is run from a temporary directory).
• Unauthorized File Access: An unauthorized user attempts to access a protected configuration file (e.g., /etc/passwd on Linux or System32 files on Windows).
• File Access Patterns: Bulk access to multiple files in a short time (e.g., mass access to documents on a file server).
• File Access via Network: Files on a network share are accessed remotely (e.g., logs of SMB file access).

A new file is created on a system or network storage. This action often signifies an operation such as saving a document, writing data, or deploying a file. Logging these events helps identify legitimate or potentially malicious file creation activities. Examples include logging file creation events (e.g., Sysmon Event ID 11 or Linux auditd logs).

The full packet capture (PCAP) or session data that logs both protocol headers and payload content. This allows analysts to inspect command and control (C2) traffic, exfiltration, and other suspicious activity within network communications. Unlike metadata-based logs, full content analysis enables deeper protocol inspection, payload decoding, and forensic investigations.

Data Collection Measures:

• Network Packet Capture (Full Content Logging)
• Wireshark / tcpdump / tshark
• Full packet captures (PCAP files) for manual analysis or IDS correlation. tcpdump -i eth0 -w capture.pcap
• Zeek (formerly Bro)
• Extracts protocol headers and payload details into structured logs. echo "redef Log::default_store = Log::ASCII;" > local.zeek | zeek -Cr capture.pcap local.zeek
• Suricata / Snort (IDS/IPS with PCAP Logging)
• Deep packet inspection (DPI) with signature-based and behavioral analysis. suricata -c /etc/suricata/suricata.yaml -i eth0 -l /var/log/suricata
• Host-Based Collection
• Sysmon Event ID 22 – DNS Query Logging, Captures DNS requests made by processes, useful for detecting C2 domains.
• Sysmon Event ID 3 – Network Connection Initiated, Logs process-to-network connection relationships.
• AuditD (Linux) – syscall=connect, Monitors outbound network requests from processes. auditctl -a always,exit -F arch=b64 -S connect -k network_activity
• Cloud & SaaS Traffic Collection
• AWS VPC Flow Logs / Azure NSG Flow Logs / Google VPC Flow Logs, Captures metadata about inbound/outbound network traffic.
• Cloud IDS (AWS GuardDuty, Azure Sentinel, Google Chronicle), Detects malicious activity in cloud environments by analyzing network traffic patterns.

Contextual data about a logon session, such as username, logon type, access tokens (security context, user SIDs, logon identifiers, and logon SID), and any activity associated within it

Refers to the event in which a new process (executable) is initialized by an operating system. This can involve parent-child process relationships, process arguments, and environmental variables. Monitoring process creation is crucial for detecting malicious behaviors, such as execution of unauthorized binaries, scripting abuse, or privilege escalation attempts..

The activity of assigning a new drive letter or creating a mount point for a data storage device, such as a USB, network share, or external hard drive, enabling access to its content on a host system. Examples:

• USB Drive Insertion: A USB drive is plugged in and automatically assigned the letter E:\ on a Windows machine.
• Network Drive Mapping: A network share \\server\share is mapped to the drive Z:\.
• Virtual Drive Creation: A virtual disk is mounted on /mnt/virtualdrive using an ISO image or a virtual hard disk (VHD).
• Cloud Storage Mounting: Google Drive is mounted as G:\ on a Windows machine using a cloud sync tool.
• External Storage Integration: An external HDD or SSD is connected and assigned /mnt/external on a Linux system..

This includes a list of any process alarms or alerts produced to indicate unusual or concerning activity within the operational process (e.g., increased temperature/pressure)

The alteration of a drive letter, mount point, or other attributes of a data storage device, which could involve reassignment, renaming, permissions changes, or other modifications. Examples:

• Drive Letter Reassignment: A USB drive previously assigned E:\ is reassigned to D:\ on a Windows machine.
• Mount Point Change: On a Linux system, a mounted storage device at /mnt/external is moved to /mnt/storage.
• Drive Permission Changes: A shared drive's permissions are modified to allow write access for unauthorized users or processes.
• Renaming of a Drive: A network drive labeled "HR_Share" is renamed to "Shared_Resources."
• Modification of Cloud-Integrated Drives: A cloud storage mount such as Google Drive is modified to sync only specific folders.

This data component can be collected through the following measures:

Windows Event Logs

• Relevant Events:
• Event ID 98: Indicates changes to a volume (e.g., drive letter reassignment).
• Event ID 1006: Logs permission modifications or changes to removable storage.
• Configuration: Enable "Storage Operational Logs" in the Event Viewer:

Applications and Services Logs > Microsoft > Windows > Storage-Tiering > Operational

Linux System Logs

• Auditd Configuration: Add audit rules to track changes to mounted drives: auditctl -w /mnt/ -p w -k drive_modification
• Command-Line Monitoring: Use dmesg or journalctl to observe drive modifications.

macOS System Logs

• Unified Logs: Collect mount or drive modification events: log show --info | grep "Volume modified"
• Command-Line Monitoring: Use diskutil to track changes:

Endpoint Detection and Response (EDR) Tools

• Configure policies in EDR solutions to monitor and log changes to drive configurations or attributes.

SIEM Tools

• Aggregate logs from multiple systems into a centralized platform like Splunk to correlate events and alert on suspicious drive modification activities.

The registration of a new service or daemon on an operating system.

Data Collection Measures:

• Windows Event Logs
• Event ID 4697 - Captures the creation of a new Windows service.
• Event ID 7045 - Captures services installed by administrators or adversaries.
• Event ID 7034 - Could indicate malicious service modification or exploitation.
• Sysmon Logs
• Sysmon Event ID 1 - Process Creation (captures service executables).
• Sysmon Event ID 4 - Service state changes (detects service installation).
• Sysmon Event ID 13 - Registry modifications (captures service persistence changes).
• PowerShell Logging
• Monitor New-Service and Set-Service PowerShell cmdlets in Event ID 4104 (Script Block Logging).
• Linux/macOS Collection Methods
• AuditD & Syslog Daemon Logs (/var/log/syslog, /var/log/messages, /var/log/daemon.log)
• AuditD Rules:
• auditctl -w /etc/systemd/system -p wa -k service_creation
• Detects changes to systemd service configurations.
• Systemd Journals (journalctl -u <service_name>)
• Captures newly created systemd services.
• LaunchDaemons & LaunchAgents (macOS)
• Monitor /Library/LaunchDaemons/ and /Library/LaunchAgents/ for new plist files.

The exit or termination of a running process on a system. This can occur due to normal operations, user-initiated commands, or malicious actions such as process termination by malware to disable security controls.

contextual information about a file, including attributes such as the file's name, size, type, content (e.g., signatures, headers, media), user/owner, permissions, timestamps, and other related properties. File metadata provides insights into a file's characteristics and can be used to detect malicious activity, unauthorized modifications, or other anomalies. Examples:

• File Ownership and Permissions: Checking the owner and permissions of a critical configuration file like /etc/passwd on Linux or C:\Windows\System32\config\SAM on Windows.
• Timestamps: Analyzing the creation, modification, and access timestamps of a file.
• File Content and Signatures: Extracting the headers of an executable file to verify its signature or detect packing/obfuscation.
• File Attributes: Analyzing attributes like hidden, system, or read-only flags in Windows.
• File Hashes: Generating MD5, SHA-1, or SHA-256 hashes of files to compare against threat intelligence feeds.
• File Location: Monitoring files located in unusual directories or paths, such as temporary or user folders.

Changes made to an existing service or daemon, such as modifying the service name, start type, execution parameters, or security configurations.

Command Execution involves monitoring and capturing the execution of textual commands (including shell commands, cmdlets, and scripts) within an operating system or application. These commands may include arguments or parameters and are typically executed through interpreters such as cmd.exe, bash, zsh, PowerShell, or programmatic execution. Examples:

• Windows Command Prompt
• dir – Lists directory contents.
• net user – Queries or manipulates user accounts.
• tasklist – Lists running processes.
• PowerShell
• Get-Process – Retrieves processes running on a system.
• Set-ExecutionPolicy – Changes PowerShell script execution policies.
• Invoke-WebRequest – Downloads remote resources.
• Linux Shell
• ls – Lists files in a directory.
• cat /etc/passwd – Reads the user accounts file.
• curl http://malicious-site.com – Retrieves content from a malicious URL.
• Container Environments
• docker exec – Executes a command inside a running container.
• kubectl exec – Runs commands in Kubernetes pods.
• macOS Terminal
• open – Opens files or URLs.
• dscl . -list /Users – Lists all users on the system.
• osascript -e – Executes AppleScript commands.

Contextual data about a service/daemon, which may include information such as name, service executable, start type, etc.

Contextual data about a scheduled job, which may include information such as name, timing, command(s), etc.

Changes made to a file, including updates to its contents, metadata, access permissions, or attributes. These modifications may indicate legitimate activity (e.g., software updates) or unauthorized changes (e.g., tampering, ransomware, or adversarial modifications). Examples:

• Content Modifications: Changes to the content of a configuration file, such as modifying /etc/ssh/sshd_config on Linux or C:\Windows\System32\drivers\etc\hosts on Windows.
• Permission Changes: Altering file permissions to allow broader access, such as changing a file from 644 to 777 on Linux or modifying NTFS permissions on Windows.
• Attribute Modifications: Changing a file's attributes to hidden, read-only, or system on Windows.
• Timestamp Manipulation: Adjusting a file's creation or modification timestamp using tools like touch in Linux or timestomping tools on Windows.
• Software or System File Changes: Modifying system files such as boot.ini, kernel modules, or application binaries.

This includes sources of current and expected software or application programs deployed to a device, along with information on the version and patch level for vendor products, full source code for any application programs, and unique identifiers (e.g., hashes, signatures).

This includes any data stores that maintain historical or real-time events and telemetry recorded from various sensors or devices

Calls made by a process to operating system-provided Application Programming Interfaces (APIs). These calls are essential for interacting with system resources such as memory, files, and hardware, or for performing system-level tasks. Monitoring these calls can provide insight into a process's intent, especially if the process is malicious.

Application Log Content refers to logs generated by applications or services, providing a record of their activity. These logs may include metrics, errors, performance data, and operational alerts from web, mail, or other applications. These logs are vital for monitoring application behavior and detecting malicious activities or anomalies. Examples:

• Web Application Logs: These logs include information about requests, responses, errors, and security events (e.g., unauthorized access attempts).
• Email Application Logs: Logs contain metadata about emails sent, received, or blocked (e.g., sender/receiver addresses, message IDs).
• SaaS Application Logs: Activity logs include user logins, configuration changes, and access to sensitive resources.
• Cloud Application Logs: Logs detail control plane activities, including API calls, instance modifications, and network changes.
• System/Application Monitoring Logs: Logs provide insights into application performance, errors, and anomalies.

The successful establishment of a new user session following a successful authentication attempt. This typically signifies that a user has provided valid credentials or authentication tokens, and the system has initiated a session associated with that user account. This data is crucial for tracking authentication events and identifying potential unauthorized access. Examples:

• Windows Systems
• Event ID: 4624
• Logon Type: 2 (Interactive) or 10 (Remote Interactive via RDP).
• Account Name: JohnDoe
• Source Network Address: 192.168.1.100
• Authentication Package: NTLM
• Linux Systems
• /var/log/utmp or /var/log/wtmp:
• Log format: login user [tty] from [source_ip]
• User: jane
• IP: 10.0.0.5
• Timestamp: 2024-12-28 08:30:00
• macOS Systems
• /var/log/asl.log or unified logging framework:
• Log: com.apple.securityd: Authentication succeeded for user 'admin'
• Cloud Environments
• Azure Sign-In Logs:
• Activity: Sign-in successful
• Client App: Browser
• Location: Unknown (Country: X)
• Google Workspace
• Activity: Login
• Event Type: successful_login
• Source IP: 203.0.113.55

This includes alarms associated with unexpected device functions, such as shutdowns, restarts, failures, or configuration changes

The execution of a text file that contains code via the interpreter.

Summarized network packet data that captures session-level details such as source/destination IPs, ports, protocol types, timestamps, and data volume, without storing full packet payloads. This is commonly used for traffic analysis, anomaly detection, and network performance monitoring.

An attempt (successful and failed login attempts) by a user, service, or application to gain access to a network, system, or cloud-based resource. This typically involves credentials such as passwords, tokens, multi-factor authentication (MFA), or biometric validation.

This includes sources of current and expected devices on the network, including the manufacturer, model, and necessary identifiers (e.g., IP and hardware addresses)

Changes made to firmware, which may include its settings, configurations, or underlying data. This can encompass alterations to the Master Boot Record (MBR), Volume Boot Record (VBR), or other firmware components critical to system boot and functionality. Such modifications are often indicators of adversary activity, including malware persistence and system compromise. Examples:

• Changes to Master Boot Record (MBR): Modifying the MBR to load malicious code during the boot process.
• Changes to Volume Boot Record (VBR): Altering the VBR to redirect boot processes to malicious locations.
• Firmware Configuration Changes: Modifying BIOS/UEFI settings such as disabling Secure Boot.
• Firmware Image Tampering: Updating firmware with a malicious or unauthorized image.
• Logs or Errors Indicating Firmware Changes: Logs showing unauthorized firmware updates or checksum mismatches.

This data component can be collected through the following measures:

• BIOS/UEFI Logs: Enable and monitor BIOS/UEFI logs to capture settings changes or firmware updates.
• Firmware Integrity Monitoring: Use tools or firmware security features to detect changes to firmware components.
• Endpoint Detection and Response (EDR) Solutions: Many EDR platforms can detect abnormal firmware activity, such as changes to MBR/VBR or unauthorized firmware updates.
• File System Monitoring: Monitor changes to MBR/VBR-related files using tools like Sysmon or auditd.
• Windows Example (Sysmon): Monitor Event ID 7 (Raw disk access).
• Linux Example (auditd): auditctl -w /dev/sda -p wa -k firmware_modification
• Network Traffic Analysis: Capture firmware updates downloaded over the network, particularly from untrusted sources. Use network monitoring tools like Zeek or Wireshark to analyze firmware-related traffic.
• Secure Boot Logs: Collect and analyze Secure Boot logs for signs of tampering or unauthorized configurations. Example: Use PowerShell to retrieve Secure Boot settings on Windows: Confirm-SecureBootUEFI
• Vendor-Specific Firmware Tools: Many hardware vendors provide tools for firmware integrity checks.Examples:
• Intel Platform Firmware Resilience (PFR).
• Lenovo UEFI diagnostics.

When a process or program dynamically attaches a shared library, module, or plugin into its memory space. This action is typically performed to extend the functionality of an application, access shared system resources, or interact with kernel-mode components.

Changes made to an existing registry key or its values. These modifications can include altering permissions, modifying stored data, or updating configuration settings.

Data Collection Measures:

• Windows Event Logs
• Event ID 4657 - Registry Value Modified: Logs changes to registry values, including modifications to startup entries, security settings, or system configurations.
• Sysmon (System Monitor) for Windows
• Sysmon Event ID 13 - Registry Value Set: Captures changes to specific registry values.
• Sysmon Event ID 14 - Registry Key & Value Renamed: Logs renaming of registry keys, which may indicate evasion attempts.
• Endpoint Detection and Response (EDR) Solutions
• Monitor registry modifications for suspicious behavior.

Refers to events where files are removed from a system or storage device. These events can indicate legitimate housekeeping activities or malicious actions such as attackers attempting to cover their tracks. Monitoring file deletions helps organizations identify unauthorized or suspicious activities.

Contextual data about a running process, which may include information such as environment variables, image name, user/owner, etc.

The establishment of a task or job that will execute at a predefined time or based on specific triggers.

Opening a network share, which makes the contents available to the requestor (ex: Windows EID 5140 or 5145)

Changes made to an existing scheduled job, including modifications to its execution parameters, command payload, or execution timing.

Prevent unauthorized installation of software on ICS assets.

Real-time monitoring identifies an ICS Windows asset bypassing designated DNS resolvers, generating tunneling-like DNS content, or establishing HTTPS/TLS sessions to unapproved DoH resolver/API infrastructure from a process not authorized for encrypted DNS. Require a resolver-policy or asset-role violation plus suspicious query/content/process/destination evidence; suppress approved browsers, security products, vendor cloud services, and documented maintenance.

Real-time monitoring identifies ICS clients sending DNS directly to unauthorized resolvers, native DNS with tunneling characteristics, or HTTPS/TLS connections to known/identified DoH infrastructure that bypass the site resolver/proxy architecture. Alert on policy violation plus content/flow corroboration; do not alert solely on high DNS volume.

Real-time monitoring identifies a Linux ICS asset bypassing designated DNS resolvers, producing tunneling-like native DNS, or connecting to unapproved DoH/DoT infrastructure from an unauthorized process/service. Require resolver-policy or asset-role violation plus corroborating process, query, or destination evidence; suppress approved package/vendor/security workflows.

Real-time monitoring identifies an embedded OT/IoT device sending DNS to a resolver not defined for its role, tunneling-like native DNS, or direct HTTPS/TLS to an unapproved DoH endpoint. Because many embedded devices have fixed communications, require deviation from the device-specific resolver/destination profile and corroborating query or destination evidence.

Real-time monitoring identifies direct PowerShell execution or indirect System.Management.Automation use with an unexpected parent, encoded/obfuscated arguments, unusual module loading, or execution followed by OT-relevant network/process activity. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.

Real-time monitoring identifies a command-line interpreter (cmd.exe, PowerShell.exe) spawned as a child of an Industrial Control System (ICS) vendor application process, where this parent-child relationship is not part of the documented normal operation of that vendor software or directly spawned processes with a command line parameters containing ICS protocol/Application Programming Interface (API) interaction keywords, from a context not associated with documented automation scripts. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a command and scripting interpreter process spawned by an Industrial Control System (ICS) service process, or interactive shell sessions from unexpected Secure Shell (SSH) source Internet Protocol (IP) addresses or an unexpected User Identifier (UID) not associated with recognized ICS automation scripts, deviating from the expected execution baseline. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies cmd.exe or .bat/.cmd execution from an unexpected parent or user context, execution from transient/user-writable paths, suspicious command chaining, or shell activity followed by OT-relevant discovery, credential, remote-access, or configuration behavior. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.

Real-time monitoring identifies sh/bash/ash/zsh/BusyBox execution from an unexpected parent, unauthorized account, remote session, or non-approved script path, particularly when followed by OT-relevant network discovery, persistence, file modification, or communications. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.

Real-time monitoring identifies network-device CLI or underlying Unix-like shell access from an unauthorized management source/account, followed by privileged or configuration commands outside an approved change window. Do not alert solely on CLI use. Require violation of the management matrix, command authorization, or change-control context.

Real-time monitoring identifies a session (Telnet, SSH, proprietary, etc.) opened to an embedded field device from a source not in the approved administrative CIDR, immediately followed by configuration-mode entry or high-risk commands (firmware operations, config write/erase, reload) or identifies sequences of Industrial Control System (ICS) protocol commands arriving at field devices that follow a scripted, deterministic pattern -- identical inter-command timing, systematic address iteration -- rather than the variable, operator-driven timing of legitimate engineering sessions. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an Industrial Control System (ICS) network-device command-line interface (CLI) commands (e.g., interface shutdown, access control list modification, network address translation changes, etc.) from a source or account outside the approved network-management baseline or network traffic patterns consistent with scripted command execution -- regular-interval connections with consistent payload sizes -- to field device Internet Protocol (IP) addresses from a host not normally exhibiting such regularity. Operational Technology (OT) operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies wscript.exe/cscript.exe, Office macro, or HTA-driven Visual Basic execution from unexpected parents/paths or followed by PowerShell, command shell, network activity, or system modification. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.

Real-time monitoring identifies wscript.exe/cscript.exe/mshta.exe or other JScript execution from unexpected parents/paths, especially when followed by child interpreters, network connections, or system modification. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.

Real-time monitoring identifies shell/CLI access to an embedded controller, gateway, HMI appliance, or IoT/OT device from an unauthorized source/account, or command execution that is inconsistent with the device role and approved maintenance workflow. Require a session/command authorization violation or corroborating configuration/firmware/process effect; do not infer maliciousness from deterministic timing alone.

Real-time monitoring identifies node/nodejs or another JavaScript runtime launched from an unexpected service, web process, scheduled task, user, or path, followed by outbound connections, shell execution, persistence, or OT-relevant access. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.

Real-time monitoring identifies python/python3 execution by unexpected users/services, from unapproved script paths, or from cron/systemd contexts not associated with documented automation, particularly when followed by OT communications, sensitive file access, persistence, or child-shell activity. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.

Real-time monitoring identifies python.exe/py.exe or packaged Python runtimes launched from unexpected parents or locations, by unauthorized identities, or followed by communications to protected OT assets, system modification, or child interpreters. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.

Real-time monitoring identifies an embedded OT/IoT device establishing MQTT/AMQP/DDS communication with a broker/service outside its device-specific profile, using an unexpected client identity/topic, or crossing an unauthorized zone boundary. Fixed-function device behavior should be compared to the documented broker/topic/destination profile rather than a generic anomaly threshold.

Real-time monitoring identifies MQTT/AMQP/DDS sessions crossing an unexpected zone boundary, connecting an ICS client to an unapproved broker/service, or using client/topic/message behavior inconsistent with the documented pub/sub architecture. Require topology/identity/topic/destination violation; periodicity alone is not sufficient.

Real-time monitoring identifies a Linux ICS service or process initiating MQTT/AMQP/DDS communications outside its approved broker/client relationship or from an unauthorized runtime/tool. Require communication-matrix violation plus process/destination/protocol corroboration; suppress approved telemetry, historian, gateway, vendor, and maintenance activity.

Real-time monitoring identifies a Windows ICS asset initiating MQTT/AMQP/DDS communications to a broker/service not approved for the asset role, from a process not associated with authorized vendor or telemetry software. Require both a communication-matrix violation and destination/process/protocol corroboration; suppress approved brokers, telemetry collectors, vendor applications, and maintenance.

Real-time monitoring identifies an Industrial Control System (ICS)-role account session originating from a Virtual Private Network (VPN)/remote access connection that subsequently accesses Windows ICS hosts in a pattern inconsistent with documented vendor support session profiles. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies exploit-pattern HTTP/HTTPS traffic targeting an ICS DMZ application from a source or request pattern outside the approved application baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Near-real-time connection monitoring identifies connections to Industrial Control System (ICS) field device management ports from Internet Protocol (IP) addresses routed through external remote access infrastructure rather than from within the expected ICS network segments. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows. This analytic is implementable from session/flow metadata (endpoints, ports, protocol/service, timing, bytes); it does not require or claim packet-payload visibility.

Real-time monitoring identifies Hypertext Transfer Protocol (HTTP) requests to an embedded Human-Machine Interface (HMI) panel's built-in web server capturing screen images, or Virtual Network Computing (VNC) connections to embedded HMI panels, from source Internet Protocol (IP) addresses not in the approved operator workstation list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Detect embedded hooking by correlating an independently acquired firmware/module integrity measurement that differs from the approved vendor/baseline image with protocol-response behavior that also departs from the device's known deterministic behavior. A protocol-response anomaly by itself does not prove a hook because firmware versions, device state, communications faults, and vendor-specific behavior can produce response differences. Treat network anomalies as corroboration and require independent integrity evidence or vendor/device attestation before escalating the condition as firmware-level hooking. Monitoring mode: periodic or event-triggered integrity verification plus near-real-time protocol monitoring where a capable OT protocol decoder is deployed.

Real-time monitoring identifies SSH lateral movement between Industrial Control System (ICS) Linux hosts not in the documented communication matrix, with subsequent ICS tool execution or privilege escalation. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a host simultaneously maintaining an inbound connection on an Industrial Control System (ICS) protocol port and an outbound connection to a destination outside the ICS network zone, detectable as correlated dual flows with matching timing and approximate byte-count proportionality. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies a scripting interpreter or custom binary on an Industrial Control System (ICS) Linux asset making sustained, high-frequency Industrial Control System (ICS) protocol read connections to field device IPs, from a User Identifier (UID) not associated with the recognized historian or Supervisory Control and Data Acquisition (SCADA) service account. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a Linux process invoking Industrial Control System (ICS) vendor write Application Programming Interfaces (APIs) or Open Platform Communications (OPC) Unified Architecture (UA) write calls to setpoint tags on field devices, from a User Identifier (UID) not associated with the authorized control application, with values exceeding the safe operating range. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Windows firewall rule additions blocking Industrial Control System (ICS) protocol ports on ICS gateway or server hosts. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) Windows host making outbound connections on HTTP/HTTPS/DNS ports to destinations outside the approved Industrial Control System (ICS) communication baseline, from processes that are not recognized Industrial Control System (ICS) vendor applications. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies Industrial Control System (ICS) protocol master-role traffic originating from a Windows host that is not the authorized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) server. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.

Real-time monitoring identifies field device access (Industrial Control System (ICS) protocol sessions, management interface authentication) using credentials or authentication tokens associated with a legitimate engineering account, but from a source Internet Protocol (IP) address or Media Access Control (MAC) address not enrolled as an authorized engineering workstation, where the authenticated session subsequently performs write operations the credential owner has not acknowledged via change control. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to power Management Information Base (MIB) restart Object Identifiers (OIDs) or Command Line Interface (CLI) reload commands from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies system binaries (bash, python, perl, awk, dd) on Industrial Control System (ICS) Linux assets executing with arguments that pipe or decode external content rather than performing their documented administrative function. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an Industrial Control System (ICS) protocol library loaded by a Linux process not in the authorized ICS applications list, making connections to the device subnet. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring of switch/router interface counters identifies a sudden spike in discarded or errored packets on an Industrial Control System (ICS)-facing interface combined with Central Processing Unit (CPU) utilization climbing above baseline, correlated with loss of reachability to downstream field devices on that segment within the same window. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.

Real-time monitoring identifies a firmware update utility on an Industrial Control System (ICS) Linux engineering host initiating a connection to a device Internet Protocol (IP) address on its firmware update port, by a User Identifier (UID) not in the approved firmware manager UIDs, outside a scheduled maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Virtual Network Computing (VNC) or proprietary remote console sessions to embedded Human-Machine Interface (HMI) panels or operator terminals from IP addresses outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, where the sessions access Industrial Control System (ICS) control interfaces with physical-plant impact. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies Industrial Control System (ICS) protocol messages using embedded device built-in utilities or vendor-supplied diagnostic tools to execute payloads, from sources not in the approved engineering workstation list, containing payloads inconsistent with legitimate diagnostic use. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an Industrial Control System (ICS) vendor process making outbound connections on commonly-allowed port (e.g., 80, 443, 8080, etc.) to a destination not in the approved vendor domain list, from a host whose documented role does not require external connectivity. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies an Industrial Control System (ICS) protocol restart command directed at a field device from a source not in the approved engineering workstation list, where multiple devices receive restart commands within a short window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies network device credential changes such as Authentication, Authorization, and Accounting (AAA) password modification or Simple Network Management Protocol (SNMP) community string modification from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, corroborated by syslog showing authentication failures from legitimate NMS systems following the change. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies configuration changes to serial server or terminal server devices that alter serial port parameters for ports connected to field devices. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies iptables/nftables rule additions blocking Industrial Control System (ICS) protocol ports on Linux ICS gateways. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) Linux service process (historian daemon, Open Platform Communications (OPC) gateway) being killed or crashing following a sustained high-rate inbound connection pattern recorded by network monitoring, correlated with daemon log entries indicating connection limit exhaustion or out-of-memory conditions. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.

Real-time monitoring identifies Industrial Control System (ICS) protocol sessions that bulk-read configuration data, program blocks, or data record objects from field devices -- function code sequences retrieving entire data dictionaries rather than operational process values -- from a source with no prior history of configuration-read sessions. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies new east-west connections between Industrial Control System (ICS) hosts on remote service ports not in the approved communication matrix. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies ptrace syscalls or /proc/pid/mem write operations targeting Industrial Control System (ICS) service processes from a process that is not a debugger or vendor diagnostic tool. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a Linux process performing sequential reads across multiple ICS configuration or data paths by a UID outside approved backup, engineering, or vendor-application accounts. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an account on an ICS Linux host invoking SSH, SNMP, or another remote-management utility with a non-local target to query remote system identity, hardware, operating-system, or inventory information outside the approved management baseline. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies execution of network enumeration tools (ss, netstat, arp, ip neigh) on an Industrial Control System (ICS) Linux asset from a User Identifier (UID) that does not normally perform network administration. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a control/command message arriving at a field device from a source not in the approved control server list, where the command targets safety-critical output points and does not correspond to any scheduled or operator-acknowledged process action. Documented precedent: Industroyer2 connected directly to specific International Electrotechnical Commission (IEC)-104 RTUs and toggled hardcoded Information Object Addresses (IOAs) to OFF using command type 46, targeting circuit breaker outputs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies transfer protocol traffic such as the Trivial File Transfer Protocol (TFTP) or vendor-specific protocol traffic initiating firmware-update mode on Industrial Control System (ICS) device Internet Protocol (IP) addresses from sources not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a Windows process joining Industrial Control System (ICS) multicast groups from a process not associated with an approved ICS protection relay monitoring tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies passwd/chpasswd modification of Industrial Control System (ICS) service account credentials by a User Identifier (UID) that is not a designated system administrator, outside a formal credential rotation procedure. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Industrial Control System (ICS) protocol sessions that bulk-read configuration data, program blocks, or data record objects from field devices, covering address ranges never queried by legitimate Supervisory Control and Data Acquisition (SCADA), suggesting systematic extraction of ICS design documentation. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies Industrial Control System (ICS) protocol requests targeting device identification and system metadata objects from a source not in the approved control server list, specifically aimed at device metadata rather than process values. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies successful authentication to a field device using credentials matching documented vendor-default values, from a source not in the approved access list. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a firmware update tool on an Industrial Control System (ICS) Linux engineering host initiating firmware-update mode activation outside a scheduled maintenance window, by a User Identifier (UID) not in the approved firmware manager UIDs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a process on an Industrial Control System (ICS) Linux asset with both a listening socket on an ICS protocol port and an outbound connection to a non-ICS destination, combined with iptables DNAT rules redirecting ICS protocol port traffic. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies a process executing iwconfig or ip link set <wlan> promisc, or loading mac80211 monitor mode, on an Industrial Control System (ICS) Linux asset outside normal configuration management activity. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies Industrial Control System (ICS) field device event logs being cleared via ICS protocol commands from a source not in the approved engineering workstation list, occurring immediately following other suspicious ICS activity on the same device. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a Windows process holding simultaneous connections to both the field device subnet and an external destination, combined with proxy-tool process creation. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies an Industrial Control System (ICS) Windows application such as a Supervisory Control and Data Acquisition (SCADA) server or Distributed Control System (DCS) interface generating anomalously high-frequency write Application Programming Interface (API) calls to field devices, exceeding the configured scan rate baseline for that point. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a mass deauthentication event targeting multiple enrolled Industrial Control System (ICS) wireless devices simultaneously, or a wireless access point configuration change excluding enrolled device Media Access Control (MAC) address from the association list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a field device or serial gateway receiving Industrial Control System (ICS) protocol traffic relayed through an intermediate host, identifiable by protocol-level timing anomalies or L2 source address changes where the device Internet Protocol (IP) address responds from a Media Access Control (MAC) address different from its enrolled hardware address. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies an Industrial Control System (ICS) Linux service process making write Application Programming Interface (API) calls to field device Input/Output (I/O) at a rate exceeding the configured scan rate, from a User Identifier (UID) associated with the Supervisory Control and Data Acquisition (SCADA)/control application but exhibiting anomalous write volume. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies multiple field devices becoming unreachable simultaneously following a network infrastructure configuration change event. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Industrial Control System (ICS) protocol messages querying network topology information from embedded devices -- neighbor device lists, Common Industrial Protocol (CIP) port object information -- from a source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies Industrial Control System (ICS) unsolicited response messages such as Distributed Network Protocol 3 (DNP3) unsolicited or Generic Object Oriented Substation Event (GOOSE) frames arriving from Internet Protocol (IP) or Media Access Control (MAC) addresses that do not match the enrolled device for those data points. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Secure Shell (SSH), web application, or Industrial Control System (ICS) Application Programming Interface (API) authentication attempts on ICS Linux servers from internet-sourced Internet Protocol (IP) addresses. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies Windows serial port configuration changes on Industrial Control System (ICS) gateway hosts that would disrupt communication with serial field devices. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an embedded field device initiating outbound connections on a commonly-used port to a destination outside the device's documented operational communication profile, which for most embedded Industrial Control System (ICS) devices normally should not include arbitrary outbound internet connectivity under the approved communications architecture. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to service-stop Object Identifiers (OIDs) or Command Line Interface (CLI) commands stopping routing/switching processes critical to Industrial Control System (ICS) communication, from sources not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Industrial Control System (ICS) field device IPs receiving inbound connections from internet-sourced IP addresses on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies ICS protocol responses whose timing or payload structure deviates from the established device-specific per-function baseline in a pattern consistent with an intercepting relay or hook. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies bulk file access on a Linux-hosted Industrial Control System (ICS) documentation repository (piping and instrumentation diagram stores, configuration archives) by a User Identifier (UID) not associated with documented engineering roles. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an Industrial Control System (ICS) Linux engineering tool issuing device restart commands outside a scheduled maintenance window, from a User Identifier (UID) not in the approved engineer list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a new Internet Group Management Protocol (IGMP) group join or multicast subscription from a source Media Access Control (MAC)/Internet Protocol (IP) not in the approved device inventory, particularly for protection-relay Generic Object Oriented Substation Event (GOOSE) datasets. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies execution of network discovery tools on an Industrial Control System (ICS) Linux asset by a User Identifier (UID) that does not normally perform network scanning. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a write to alarm configuration files or database tables on an Human-Machine Interface (HMI)/alarm server by a process other than the recognized alarm management application, or an alarm-class-disable Application Programming Interface (API) call logged without a corresponding operator session ID in the HMI audit trail. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies systemctl stop or kill commands targeting Industrial Control System (ICS) service processes on Linux assets, from a User Identifier (UID) that is not the ICS service owner or an authorized system administrator. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Industrial Control System (ICS) Linux service processes initiating outbound application-layer protocol connections to ports/destinations outside the approved communication matrix. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies Industrial Control System (ICS) network device syslog showing a gap in expected event sequence numbers, or syslog forwarding interruption from a device coinciding with a period of suspicious activity on that device. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies Industrial Control System (ICS) protocol traffic originating from one field device Internet Protocol (IP) address to another field device, a pattern not consistent with the documented device-to-supervisory communication topology. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies Industrial Control System (ICS) protocol messages using vendor-specific or undocumented function codes that access device hardware registers directly rather than through the normal ICS application layer, from a source not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies vendor-specific firmware-update protocol traffic to ICS device IP addresses from a source not in the approved engineering-workstation or firmware-management baseline. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an ICS device presenting protocol identity attributes (for example vendor, product, model, or capability identifiers) that conflict with the identity and capabilities recorded for that network address/device in the authorized asset inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time network monitoring identifies a source generating Industrial Control System (ICS) discovery broadcasts or sequential connection attempts across the full IP range of a device subnet, from a source not in the approved engineering/Supervisory Control and Data Acquisition (SCADA) inventory. Documented in the PIPEDREAM/INCONTROLLER toolset's CODECALL module for EtherNet/IP device discovery. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a password change event for an Industrial Control System (ICS) service or operator account performed by an account not in the authorized credential administration role, immediately followed by failed authentication attempts from the Industrial Control System (ICS) service itself. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a Linux process generating Industrial Control System (ICS) protocol unsolicited responses or publishing Open Platform Communications Unified Architecture (OPC UA) data changes for device addresses it does not own, from a User Identifier (UID) not associated with the authorized data acquisition service. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Simple Network Management Protocol (SNMP) GET requests targeting system information Object Identifiers (OIDs) from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, directed at Industrial Control System (ICS) server or device IPs. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies deauthentication frames targeting enrolled Industrial Control System (ICS) wireless device Media Access Control (MAC) address from a source not in the approved wireless infrastructure. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host writing setpoint values to Open Platform Communications (OPC) Data Access (DA)/Unified Architecture (UA) tags or historian writable tags without being the recognized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) control application, with values falling outside the normal operating range. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies successful SSH or application authentication using credentials matching known default or hardcoded vendor passwords on Industrial Control System (ICS) Linux assets. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a vendor firmware update tool activating firmware-update mode on a field device from a Windows host, outside a scheduled maintenance window or by an account not in the approved firmware management role. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies writes to serial device configuration files or stty commands changing serial port parameters on Industrial Control System (ICS) Linux gateway hosts from a User Identifier (UID) not associated with authorized serial port management. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a new device on the Industrial Control System (ICS) network placing its Network Interface Card (NIC) in promiscuous mode, detectable by anomalous broadcast traffic handling or unauthorized Switched Port Analyzer (SPAN) session requests on managed switches. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time network monitoring identifies a field device's source Media Access Control (MAC) address changing without a corresponding documented hardware replacement, combined with protocol-level anomalies (transaction identifier reuse, function-code patterns deviating from baseline) for traffic associated with that device Internet Protocol (IP) address. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies authentication attempts against Industrial Control System (ICS) network device management interfaces using well-known default vendor credentials from source Internet Protocol (IP) addresses not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet range. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a host process making sequential Industrial Control System (ICS) protocol reads with output piped to a local staging file, from a process not associated with a recognized Human-Machine Interface (HMI) or historian tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a Linux process joining Industrial Control System (ICS) multicast groups via socket() with IP_ADD_MEMBERSHIP, from a User Identifier (UID) not associated with any authorized ICS protection system monitoring application. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies hostapd or wireless controller configuration changes on Linux-based access points disabling the Industrial Control System (ICS) wireless Service Set Identifier (SSID), by a User Identifier (UID) not in the authorized wireless admin UIDs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies rapid, bulk deletion of files across Industrial Control System (ICS) data directories on a Linux asset, by a User Identifier (UID) not associated with documented data retention management, correlated with worm-based propagation indicators consistent with documented Linux wiper malware (Awfulshred, SoloShred). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies traffic on an Industrial Control System (ICS) protocol port (e.g., 502, 20000, 44818, etc.) with payload content that does not conform to the expected protocol structure for that port, suggesting non-ICS traffic tunneled over ICS port numbers to evade port-based filtering or blend with expected traffic patterns. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a Windows process enabling promiscuous or monitor mode on a wireless adapter on an Industrial Control System (ICS) workstation that is not a designated wireless management station, indicating preparation for wireless interception. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a process on an Industrial Control System (ICS) Linux asset setting a wireless interface to monitor mode via iwconfig or netlink calls, from a User Identifier (UID) not associated with documented wireless diagnostics. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies Windows host-based firewall or network policy changes that selectively block Industrial Control System (ICS) communication traffic types from Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) hosts. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Open Platform Communications (OPC) Unified Architecture (UA) client process on a Linux Industrial Control System (ICS) host calling browse/enumerate operations against the full namespace, from a User Identifier (UID) not associated with recognized monitoring tools. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies successful Secure Shell (SSH) or application authentication using credentials matching known default vendor passwords on Industrial Control System (ICS) Linux assets. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a registry write to Windows autorun keys or an AutoPlay/AutoRun configuration change referencing a binary path that is not part of the authorized Industrial Control System (ICS) software inventory, particularly in combination with removable media insertion. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an Industrial Control System (ICS) embedded device executing a sequence of operations inconsistent with its programmed logic, correlating temporally with an operator interaction on an engineering terminal connected to the device. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a Windows process making Industrial Control System (ICS) protocol connections to device subnets from a process not in the authorized ICS applications list, structurally valid traffic from an unauthorized source. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) Linux service process initiating an outbound connection on a commonly-used port to a destination not in the approved vendor domain list. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies web server or Industrial Control System (ICS) application logs showing exploit-pattern requests to Industrial Control System (ICS) vendor web interfaces, followed by the web server daemon User Identifier (UID) spawning unexpected shell processes. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Analyst implementation must limit predicates to fields actually retained by the web server/WAF (for example URI/path/query/header/status/source); request-body or payload signatures require WAF/DPI or request-body logging and must not be inferred from a basic access log.

Real-time monitoring identifies ip link set down commands on Industrial Control System (ICS) Linux gateway hosts by a User Identifier (UID) not in the authorized net admin UIDs, affecting the device subnet interface. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Simple Network Management Protocol (SNMP) walk requests, Cisco Discovery Protocol (CDP)/Link Layer Discovery Protocol (LLDP) enumeration frames, or Internet Control Message Protocol (ICMP)-based traceroute sequences from an Industrial Control System (ICS) host that has not previously generated management-protocol traffic. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an Industrial Control System (ICS) Windows service (Open Platform Communications (OPC) server, historian, Supervisory Control and Data Acquisition (SCADA) polling service) consuming abnormal Central Processing Unit (CPU)/memory resources and becoming unresponsive following receipt of a high volume of connections to its application port, correlated with watchdog timeout or service crash events. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.

Monitor OPC UA server audit events for state-changing Write or Method service invocations and compare ClientUserId, ClientApplicationUri, SourceNode/MethodId, status, and arguments with the approved client/method baseline. For servers that support auditing, AuditWriteUpdateEventType and AuditUpdateMethodEventType provide an analyst-visible record of writes and state-changing method calls. Alert on successful or attempted control operations from unapproved clients/users or against methods/nodes outside the documented engineering workflow; do not describe this as Windows OS API telemetry.

Real-time monitoring identifies a Windows process enabling promiscuous or monitor mode on a wireless adapter (netsh wlan, WinPcap/Npcap driver load, etc.) on an Industrial Control System (ICS) workstation that is not a designated wireless management station, indicating preparation for wireless interception consistent with this technique's reconnaissance phase. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies an Industrial Control System (ICS) network device receiving a configuration erase command from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, or outside a change-control window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) vendor software package whose installation, via package manager, creates unexpected files or starts unrecognized services not documented in the vendor's package manifest. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a mount event for removable storage media on an Industrial Control System (ICS) Linux asset, followed by execution of a binary from the mounted path within a short window. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies an Industrial Control System (ICS) device or server accepting an inbound connection on its native protocol port from a source Internet Protocol (IP) address outside the organization's address space. Documented in Trend Micro's manufacturing honeypot research, with adversaries exploiting exposed Siemens S7, Omron Factory Interface Network Service (FINS), EtherNet/IP, and misconfigured Virtual Network Computing (VNC). OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies an Industrial Control System (ICS) protocol write specifically targeting alarm threshold/deadband configuration registers from a source not in the approved engineering list, where the new value widens the alarm deadband or shifts the trip point beyond the safe operating envelope, without operator acknowledgment. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a Windows process sending Industrial Control System (ICS) broadcast discovery frames from a process not associated with a recognized ICS asset management or commissioning tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies network traffic to Industrial Control System (ICS) Application Programming Interface (API) ports such as 4840 used in the Open Platform Communications (OPC) Unified Architecture (UA) or vendor-specific API ports from source Internet Protocol (IP) addresses not in the approved application client list, where the traffic pattern is consistent with write/control method invocations rather than subscription/read traffic. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a new device connecting to an Industrial Control System (ICS) network switch port that was previously unused or previously assigned to a different device Media Access Control (MAC) address immediately following physical access to the environment, with subsequent Industrial Control System (ICS) protocol traffic to field devices. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies unauthorized Switch Port Analyzer (SPAN) session configuration or port mirroring enabled from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) on an Industrial Control System (ICS) switch. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a write to alarm threshold configuration files on a Linux-based alarm server by a User Identifier (UID) that is not the alarm management service. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a process opening a raw socket or executing tcpdump/tshark on an Industrial Control System (ICS) Linux asset's network interface, from a User Identifier (UID) that does not normally perform packet capture. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies NetFlow showing a host generating an anomalously high volume of short-duration flows to multiple field device IPs at regular intervals, from a source not in the approved Supervisory Control and Data Acquisition (SCADA) server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an Industrial Control System (ICS) protocol file-transfer service placing a file on a field device from a source not in the approved engineering workstation list, where the transferred filename pattern matches firmware images or executable payloads inconsistent with the device's normal data exchange profile. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies network device configuration changes (network address translation rules, static routes, access control list modifications) combined with NetFlow path deviations for Industrial Control System (ICS) device traffic and Transport Layer Security (TLS) certificate issuer anomalies in Operational Technology (OT) management traffic. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.

Real-time monitoring identifies inconsistencies between auditd-recorded process activity and what /proc reports, or kernel module loads from non-standard paths on Industrial Control System (ICS) Linux assets. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies Windows host-based firewall rule modifications or network interface configuration changes on Industrial Control System (ICS) Windows servers that block ICS command-message traffic, coinciding with Supervisory Control and Data Acquisition (SCADA) showing communication loss to field devices. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Secure Shell (SSH) sessions with X11 forwarding or Virtual Network Computing (VNC) connections to Industrial Control System (ICS) Linux hosts from unexpected source Internet Protocol (IP) addresses, combined with X11 application launches from the session. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies modification of udev rules or autofs configuration that triggers script execution on removable media mount, where the triggered script path is not in the authorized Industrial Control System (ICS) software inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a write to alarm configuration files on a Linux-based Supervisory Control and Data Acquisition (SCADA)/alarm server by a User Identifier (UID) that is not the alarm management service, or the alarm management service process receiving Application Programming Interface (API) calls that suppress alarm classes without a corresponding operator session. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a switch interface transitioning to administratively-down state on a port connected to an Industrial Control System (ICS) field device, from a configuration change source not in the approved network administration list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) protocol command sequence that erases device memory, from a source not in the approved engineering workstation list, where the device subsequently becomes unresponsive or requires re-commissioning. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Open Platform Communications (OPC) client process on an Industrial Control System (ICS) Windows host calling BrowseNamespace or GetProperties to enumerate the full tag tree, from a process not associated with a recognized Human-Machine Interface (HMI) or historian tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a process setting LD_PRELOAD before launching an Industrial Control System (ICS) service binary, or writing to /etc/ld.so.preload, where the injected library path is not part of the vendor's package manifest. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a write to Industrial Control System (ICS) project file paths on a Linux engineering station from a User Identifier (UID) not associated with the ICS engineering tool, or from the tool after loading a file from a removable media or network path not in the approved software distribution list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies execution on an ICS Linux asset of an executable or script from a path commonly used for inbound file transfer or staging, by a UID outside the approved deployment/administration baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a process whose executable name matches a known Industrial Control System (ICS) service daemon but whose execution path falls outside the documented vendor installation directories, or whose binary hash does not match the package manager's recorded checksum for that package. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies execve of port scanning utilities on an Industrial Control System (ICS) Linux asset with arguments targeting ICS protocol port ranges. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies an Industrial Control System (ICS) protocol file-transfer service such as Distributed Network Protocol 3 (DNP3) File Transfer Object or Internet Electrotechnical Commision (IEC) 61850 file service being used to place files on a field device from a source not in the approved engineering workstation list, outside a scheduled maintenance window, where the transfer source is a device not previously enrolled. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies Industrial Control System (ICS) vendor engineering software initiating a device restart command from a Windows host outside a scheduled maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Secure Shell (SSH) connection to an Industrial Control System (ICS) Linux asset from a source Internet Protocol (IP) address that appeared on the ICS network within a short window and is not in the approved device inventory. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a new device appearing on the Industrial Control System (ICS) network with network behavior consistent with an ICS master station, with a Media Access Control (MAC) address not in the approved device inventory. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.

Real-time monitoring identifies truncation or deletion of Industrial Control System (ICS) application or auth log files, or modification of bash history, by a User Identifier (UID) that does not normally manage log rotation. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a Linux process sending User Datagram Protocol (UDP) broadcast packets to Industrial Control System (ICS) discovery addresses from a User Identifier (UID) not associated with any recognized ICS commissioning tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies large outbound data transfers from Industrial Control System (ICS) server Internet Protocol (IP) addresses to destinations outside the approved ICS zone, following a pattern of bulk reads from engineering document stores or historian databases. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a process making direct ioctl or mmap syscalls against Industrial Control System (ICS) hardware device files, bypassing the vendor's documented Application Programming Interface (API) layer, from a process not in the recognized ICS application list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies iptables/nftables rule additions on Industrial Control System (ICS) Linux gateways that filter ICS command messages based on content, while allowing other traffic to pass. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies malformed, oversized, or out-of-spec ICS protocol messages sent to an embedded field device from an unexpected or unauthorized source. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies authentication attempts against Industrial Control System (ICS) network device management interfaces using default or hardcoded vendor credentials from sources not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a write to alarm threshold configuration on an Human-Machine Interface (HMI)/alarm server from a process other than the recognized alarm management application, without a corresponding operator session. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies rapid sequential Industrial Control System (ICS) protocol connection attempts to the same field device Internet Protocol (IP) address across different protocol ports from a single source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies broadcast discovery frames on the Industrial Control System (ICS) network from a source Media Access Control (MAC)/Internet Protocol (IP) address not in the approved device inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies a Linux process making Open Platform Communications (OPC) Unified Architecture (UA) write calls or direct Industrial Control System (ICS) protocol command connections to field device output addresses, from a User Identifier (UID) not associated with the authorized control application. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host querying device operating state or process values via vendor Application Programming Interfaces (APIs) at a frequency or scope exceeding documented Human-Machine Interface (HMI) refresh behavior, from a process not in the recognized HMI/Supervisory Control and Data Acquisition (SCADA) application list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies device_ip offline alarm coinciding with switch port admin-down syslog for that port, distinguishing deliberate Ethernet blocking from physical disconnection. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies an Industrial Control System (ICS) operator/service account being granted elevated Windows privileges without a corresponding administrative logon event, or a process crash in an Industrial Control System (ICS) vendor application immediately followed by a new process inheriting elevated token privileges. Documented in PIPEDREAM's LAZYCARGO component, which drops and exploits a known vulnerable ASRock driver to elevate credentials. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a process invoking screen capture Application Programming Interfaces (APIs) targeting an Human-Machine Interface (HMI) or operator workstation window, where the calling process is not a recognized Industrial Control System (ICS) vendor application or approved remote support tool, immediately followed by an image file write. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Use an OT-capable protocol decoder to monitor SNMP requests/responses and identify access to vendor-internal or undocumented OIDs from sources outside the approved NMS inventory, especially SET operations or unusual walks against control-network infrastructure. This is network-protocol observation, not OS API execution; require decoded SNMP transaction content or equivalent packet inspection.

Real-time monitoring identifies a network infrastructure device exhibiting behavioral anomalies (unexpected listening ports, new routing entries) after a vendor firmware update or hardware replacement, where the device firmware hash does not match the authorized inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a write to a Siemens project file path on a Linux engineering workstation from a User Identifier (UID) not associated with the Siemens engineering tool runtime. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a vendor firmware update utility executing outside a scheduled maintenance window or invoked by an account not in the approved firmware management role, immediately followed by a network session to a field device IP on its firmware protocol port. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Periodic or event-triggered integrity verification identifies field devices with firmware or configuration that differs from the vendor-published authorized baseline, detected by comparing device firmware hashes against the authorized firmware inventory, appearing immediately after a vendor-supplied update or hardware replacement. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Monitoring reality: this is an integrity/posture analytic, not a universal streaming field-device event; collection cadence depends on the vendor integrity interface, asset-management system, or acquisition workflow.

Real-time monitoring identifies an ICS Linux network-facing service spawning a shell, interpreter, or other child process outside the expected service-child baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an Industrial Control System (ICS) vendor process crashing unexpectedly, immediately preceded by an unusual cross-process memory access event from a process outside the recognized security/diagnostic tool allowlist. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies Internet Control Message Protocol (ICMP) echo sweeps, Address Resolution Protocol (ARP) broadcast floods, or Industrial Control System (ICS)-specific discovery protocol packets from a host generating traffic to all IPs in a subnet in sequential order, a sweep pattern distinct from normal operational traffic to known device Internet Protocol (IP) addresses only. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies successful authentication to an Industrial Control System (ICS) device or application using credentials that are either documented vendor defaults (T1694.001) or extracted from configuration files/firmware where stored in cleartext (T1694.002), from a source not in the approved access list. This technique-level analytic unifies both sub-techniques. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies a user-facing application on an ICS Linux workstation spawning a child process outside the expected application-child baseline. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies Secure Shell (SSH) or local authentication by an Industrial Control System (ICS) service or operator account from a source Internet Protocol (IP) address outside the approved administrative Classless Inter-Domain Routing (CIDR) subnet, or a sudo/su escalation event by an ICS service account that does not normally require interactive privilege escalation, correlated with subsequent execution of ICS engineering tools. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies remote console or web management sessions to Industrial Control System (ICS) network devices from IP addresses that are not approved Network Management System (NMS) hosts, where the sessions access device configuration interfaces. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies ACL modifications on Industrial Control System (ICS) network devices specifically blocking ICS reporting message ports while allowing command ports to remain open. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a network-device ACL, filter, or rate-limit policy change that suppresses or blocks ICS alarm-notification traffic outside the approved network-change baseline. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a field device ceasing to send expected unsolicited reports or periodic status updates without a corresponding device alarm or maintenance event, while the device remains reachable via direct polling. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies NetFlow showing a source making sequential connections to multiple field device Internet Protocol (IP) addresses, each resulting in large response payloads characteristic of directory listing rather than value reads. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies Windows firewall changes blocking unsolicited Industrial Control System (ICS) reporting traffic while leaving polling/command traffic unaffected, resulting in Supervisory Control and Data Acquisition (SCADA) losing event-driven visibility while retaining polling capability. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies Open Platform Communications (OPC) Unified Architecture (UA) method invocations or International Electrotechnical Commission (IEC) 61850 Abstract Common Services Interface (ACSI) service requests arriving at a field device from a client identity not in the approved application allowlist, where the invoked method is a write or control operation rather than read/subscribe. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an abrupt cessation of expected Industrial Control System (ICS) protocol traffic between a Supervisory Control and Data Acquisition (SCADA)/control server and a field device, without a corresponding device alarm or scheduled maintenance event, while the device remains reachable for at least some traffic types. This technique-level analytic synthesizes Command Message blocking (T1691.001) and Reporting Message blocking (T1691.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring cross-correlates a field device's reported telemetry against an independent secondary measurement, identifying cases where the reported value diverges from the independent reading while the device's network-layer identity shows a MAC mismatch against its enrolled hardware address. Spoofed reporting messages are, by definition, designed to look protocol-valid. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

Real-time monitoring identifies a scripting interpreter process iterating through Industrial Control System (ICS) data sources and writing output to a local file or piping to a network socket, by a User Identifier (UID) not associated with documented automation scripts. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

Real-time monitoring identifies network device management session authentication such as Secure Shell (SSH), Remote Authentication Dial-In User Service (RADIUS), and Terminal Access Controller Access-Control System Plus (TACACS+) using valid Industrial Control System (ICS) network administrator credentials but originating from source IPs outside the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet or at times inconsistent with the account's normal usage pattern, where the session performs configuration changes not reflected in any open change-control ticket. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies an email client or Office application process spawning a script interpreter or shell process on an Industrial Control System (ICS) engineering or operator workstation, immediately following the opening of an email attachment. Documented across multiple ICS incident reports as a primary initial access vector. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies an SSH authentication/session to an ICS Linux asset from a VPN-assigned or remote-access source outside the approved remote-administration baseline. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies network device management commands succeeding from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, following exploit-pattern traffic to the device's management interface, suggesting exploitation of a management-plane vulnerability to gain elevated access without valid credentials. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies Industrial Control System (ICS) host telemetry gaps -- process lists differing between Windows Management Instrumentation (WMI) and direct enumeration, or unexpected kernel driver loads from unexpected paths -- suggesting kernel-level manipulation of what the Operating System (OS) reports. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a process owned by an Industrial Control System (ICS) service User Identifier (UID) executing a Set User Identifier (SUID) binary or exploiting a kernel vulnerability to obtain root privileges, detected via unexpected setuid/setgid syscalls from a process not invoked via sudo. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a Linux process opening Industrial Control System (ICS) protocol master connections to multiple field device Internet Protocol (IP) addresses, from a host that is not the authorized Supervisory Control and Data Acquisition (SCADA) server. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.

Real-time monitoring identifies Industrial Control System (ICS) network device telemetry gaps -- Simple Network Management Protocol (SNMP) polling returning inconsistent results, syslog sequence gaps -- suggesting kernel-level manipulation of device-reported state. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies exploit-pattern ICS/network traffic, including malformed packets, out-of-spec function codes, or overflow-sized payloads, targeting ICS servers or field devices from unexpected sources. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a browser process on an Industrial Control System (ICS) Linux workstation spawning child processes that execute with arguments inconsistent with normal browsing, or writing binaries to /tmp or user home directories. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies Hypertext Transfer Protocol (HTTP) requests to an embedded device's management web interface containing exploit-pattern content (oversized parameters, directory traversal sequences) from a source not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Near-real-time connection monitoring identifies an embedded field device or gateway initiating outbound connections on standard application-layer protocol ports to destinations outside the expected Industrial Control System (ICS) communication baseline. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. This analytic is implementable from session/flow metadata (endpoints, ports, protocol/service, timing, bytes); it does not require or claim packet-payload visibility.

Real-time monitoring identifies an Industrial Control System (ICS) field device or embedded engineering terminal receiving malformed or exploit-payload data via its built-in communication interface from an external source, designed to exploit a vulnerability in the device's communication stack. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies Industrial Control System (ICS) network device syslog recording unexpected restarts or crashes coinciding with anomalous traffic patterns on management interfaces. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies a host generating rapid, sequential Transmission Control Protocol (TCP) connection attempts across multiple destination ports on Industrial Control System (ICS) device Internet Protocol (IP) addresses, targeting ICS-specific protocol ports, from a source not in the approved control server inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.