Listen to this Post
Introduction:
In the world of Operational Technology (OT) security, building an effective Security Operations Center (SOC) requires a paradigm shift from traditional IT-centric approaches. Success hinges not on collecting every possible log, but on achieving operationally meaningful visibility that distinguishes between routine engineering actions and malicious activities threatening safety and reliability. This article provides the technical blueprints for implementing ten critical OT detection use cases, transforming raw alerts into actionable operational intelligence.
Learning Objectives:
- Implement network monitoring to detect unauthorized ICS protocol traffic and device changes.
- Develop detection rules for malicious PLC programming and firmware manipulation.
- Configure security tools to identify anomalous remote access and engineering software usage.
You Should Know:
1. Detecting Unauthorized PLC Programming
Unauthorized changes to Programmable Logic Controller (PLC) logic can halt production or cause physical damage. Detection focuses on identifying programming sessions outside approved maintenance windows.
Wireshark Filter for S7Comm Traffic:
`s7comm.param.func == 0x1f0 && frame.time > “2024-01-01 18:00:00” && frame.time < "2024-01-01 06:00:00"` Step-by-Step Guide: This filter captures Siemens S7Comm "Start Upload" function codes (0x1f0) occurring outside business hours (e.g., between 6 PM and 6 AM). In Wireshark, apply this filter to a packet capture from the OT network segment containing PLCs. Correlate any hits with change management tickets. An upload request without a corresponding ticket is a high-severity incident.
Zeek (Bro) Script for Ethernet/IP:
`event enip_cip_command(c: connection, is_orig: bool, command: count, length: count, data: string) { if (command == 0x4f && !c$id$orig_h in authorized_engineering_stations) { NOTICE([$note=OT::PLC_Program_Upload, $conn=c, $msg=”Unauthorized CIP connection for program upload detected”]); } }`
Step-by-Step Guide: This custom Zeek script monitors for the EtherNet/IP “CIP Connection Manager” command (0x4f) used to initiate a programming session. It checks the source IP against a predefined set of authorized_engineering_stations. Deploy this script on a Zeek sensor monitoring the control VLAN. Alerts indicate a potential unauthorized programming attempt.
2. Flagging ICS Protocols in IT Zones
The presence of industrial protocols like Modbus TCP on corporate IT networks is a primary indicator of failed network segmentation, creating a path for attackers.
Suricata/Snort Rule:
`alert tcp any 502 -> $IT_NETWORKS any (msg:”OT PROTOCOL – Modbus TCP in IT Zone”; flow:to_client,established; content:”|00 00 00 00 00 06|”; depth:6; offset:2; sid:1000001; rev:1;)`
Step-by-Step Guide: This rule triggers an alert when a Modbus TCP packet (destined for port 502) is seen communicating with an IP range defined in the `$IT_NETWORKS` variable. The `content` field looks for the typical Modbus Application Data Unit (ADU) header. Deploy this rule on the border firewall or network segmentation gateway between IT and OT.
Zeek Log Analysis (dns.log):
`cat dns.log | zeek-cut id.orig_h query answers | grep “modbus\|dnp3\|bacnet” | grep $IT_NETWORK_RANGE`
Step-by-Step Guide: This command parses Zeek’s DNS logs to find any DNS queries for industrial protocol-related hostnames (e.g., “modbus-gateway”, “dnp3-server”) originating from IT network IPs. This can detect reconnaissance or misconfigured clients attempting to find OT systems from the corporate network.
3. Detecting PLC Stop Commands
A STOP command sent to a PLC can immediately halt a industrial process. Distinguishing between an authorized emergency stop and a malicious act is critical.
YARA Rule for Modbus Traffic Capture:
`rule modbus_stop_command { strings: $a = { 00 00 00 00 00 06 FF 06 00 00 00 00 } condition: $a }`
Step-by-Step Guide: This YARA rule scans packet capture files for a specific Modbus TCP payload. The bytes `FF 06` represent a “Write Single Register” request to a specific coil address (often 0x0000) with a value of 0x0000, which can be a stop command. Use this with tools like `yara` to retrospectively analyze suspicious traffic captures.
Sigma Rule for Siemens S7 STOP:
title: Siemens S7 PLC Stop Command logsource: product: zeek service: s7comm detection: s7comm_param: - Function: 'PLC Stop' S7 "Plc Stop" command (0x29) condition: s7comm_param falsepositives: - Scheduled maintenance level: high
Step-by-Step Guide: This Sigma rule can be converted for use in a SIEM like Elasticsearch or Splunk. It searches for S7Comm logs where the function is “PLC Stop” (0x29). Integrate this rule with your log ingestion pipeline and configure alerts to be sent to the OT SOC, ensuring they are tagged as high severity.
4. Identifying Unauthorized Remote Access to HMIs
Human-Machine Interfaces (HMIs) are high-value targets. Detecting remote access from unapproved subnets is key to blocking lateral movement.
Windows Security Log Query (for RDP):
`EventID=4624 LogonType=10 SourceNetworkAddress=/^(?!192\.168\.1\.)./`
Step-by-Step Guide: Run this query on your SIEM or directly on the HMI’s Windows Event Log. It finds successful RDP logins (Event ID 4624) where the logon type is “RemoteInteractive” (10) and the source IP is not from the approved OT engineering network (e.g., 192.168.1.0/24). This directly points to access from an unauthorized IT or external network.
Zeek Notice for VNC:
`event connection_established(c: connection) { if (c$id$resp_p == 5900/tcp && c$id$orig_h in unauthorized_subnets) { NOTICE([$note=OT::Unauthorized_VNC_Access, $conn=c, $msg=”VNC connection from unauthorized subnet”]); } }`
Step-by-Step Guide: This Zeek script monitors for new TCP connections on the default VNC port (5900). If the connection originates from a subnet defined in `unauthorized_subnets` (e.g., the corporate wireless network), it generates an immediate alert.
5. Catching New Devices in Control VLANs
Control networks are deterministic; new devices should only appear after a rigorous change control process.
Nmap Scan for Baseline & Monitoring:
`nmap -sn 192.168.1.0/24 -oX baseline_scan.xml`
`ndiff baseline_scan.xml current_scan.xml`
Step-by-Step Guide: First, run an `nmap` ping sweep of your control VLAN (e.g., 192.168.1.0/24) during a known-quiet period and save the output as a baseline XML file. For ongoing monitoring, run the same scan periodically and use the `ndiff` tool to compare it against the baseline. Any new IP addresses reported are unauthorized devices that require immediate investigation.
Zeek `known_services` & `known_hosts` Framework:
` In zeekctl/config/node.cfg, ensure tracking of all hosts.`
` Then, use the following policy script:`
`@load policy/protocols/conn/known-hosts`
`event known_host_added(host: addr, d: string) { if (host in Control_VLAN_Subnet) { NOTICE([$note=OT::New_Device_In_Control_VLAN, $msg=fmt(“New host %s seen in control VLAN”, host)]); } }`
Step-by-Step Guide: Zeek’s `known_hosts` framework automatically tracks new IP addresses. This policy script triggers an alert whenever a new host is discovered within the predefined Control_VLAN_Subnet. This provides real-time detection of rogue devices as soon as they attempt network communication.
6. Detecting PLC Firmware Downgrades
Attackers may downgrade firmware to exploit known vulnerabilities. This is detected by monitoring for specific function codes and traffic patterns.
Wireshark Display Filter for S7 Firmware Download:
`s7comm.param.func == 0x1d0`
Step-by-Step Guide: In Siemens S7Comm, the function code 0x1d0 corresponds to “Download Block” (often used for firmware). Use this filter in Wireshark to isolate all firmware download traffic. Capture this traffic and compare the timing and source IP against the plant’s firmware update policy. Unauthorized downloads, especially those not from the engineering workstation, are critical alerts.
Custom Zeek Logging for Firmware Transfers:
`event file_transferred(f: fa_file, c: connection, is_orig: bool) { if (c$id$resp_p == 102/tcp && f$mime_type == “application/octet-stream”) { Log::write(OT::Firmware_Transfer, [$conn=c, $file=f]); } }`
Step-by-Step Guide: This script leverages Zeek’s file analysis framework. It logs any file transfer over the common industrial port 102/tcp (used by S7Comm, etc.) where the file is identified as a firmware-like binary (application/octet-stream). The resulting log can be correlated with change management data to identify unauthorized transfers.
7. Identifying Anonymous OPC UA Sessions
OPC UA sessions without proper authentication are a severe risk, allowing unauthorized data access or control.
OPC UA Client Security Policy Check (Python):
from opcua import Client
client = Client("opc.tcp://<server_url>:4840")
try:
client.set_security_string("Basic256Sha256,SignAndEncrypt,certificate.pem,private_key.pem")
client.connect()
print("Secure connection established.")
except Exception as e:
print(f"Failed secure connection: {e}")
Attempt anonymous connection for testing
try:
client.set_security_string("None,None")
client.connect()
print("WARNING: Server allows anonymous connections!")
except:
print("Server does not allow anonymous connections.")
Step-by-Step Guide: This Python script using the `opcua` library first attempts a secure, authenticated connection. If that fails, it deliberately tests for an anonymous connection (security policy “None”). A successful anonymous connection indicates a severe server misconfiguration that must be remediated.
What Undercode Say:
- Context is King: Raw alerts are meaningless in OT. A “PLC Stop” command is a normal event during an emergency shutdown but a catastrophic attack during production. The SOC’s effectiveness is directly proportional to its integration with operational context—maintenance schedules, authorized personnel, and process baselines.
- Focus on High-Impact, Low-Frequency Events: OT detections must prioritize actions that cause physical consequences. An unauthorized device or a firmware change is a far greater threat than a port scan. The provided use cases target the specific TTPs (Tactics, Techniques, and Procedures) used in real-world OT attacks like TRITON and Industroyer, moving beyond theoretical IT-based models.
Prediction:
The convergence of IT and OT networks will accelerate, driven by Industry 4.0 and IIoT. This will expand the attack surface, making context-aware OT SOCs not just an advantage but a necessity for critical infrastructure protection. We predict a rise in AI-powered attacks that learn process behaviors to execute subtle, highly damaging manipulations that evade traditional signature-based detection. The future OT SOC will rely on deep-learning models trained on process telemetry to detect these sub-perceptual anomalies, making the foundational use cases outlined here the essential baseline for more advanced, predictive defense.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mohamed Atta – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
