50 Hands-On OT/ICS Cybersecurity Projects: From Virtual PLC Labs to Threat Hunting – Your Practical Roadmap + Video

Listen to this Post

🐢▶️ Listen🚀

Introduction:

Operational Technology (OT) security cannot be learned through theory alone. Industrial environments behave fundamentally differently from traditional IT systems—PLCs, HMIs, SCADA platforms, engineering workstations, and industrial protocols introduce operational constraints where availability and physical safety matter as much as confidentiality. This article presents a practical roadmap of 50 hands-on OT/ICS cybersecurity projects designed to bridge the gap between conceptual knowledge and real-world industrial defense, emphasizing documentation, detection, and risk reduction without disrupting operations.

Learning Objectives:

• Build and configure a virtual PLC laboratory environment for safe security testing.
• Analyze industrial protocols (Modbus, S7, DNP3) using Wireshark and develop custom detection filters.
• Map OT cyber incidents to the MITRE ATT&CK for ICS framework and develop threat-hunting playbooks.
• Harden engineering workstations, create Software Bills of Materials (SBOMs), and design incident response tabletop exercises.

You Should Know

1. Building a Virtual PLC Lab with OpenPLC and Wireshark

The foundation of practical OT security is a safe, isolated environment where you can interact with programmable logic controllers without risking physical equipment. OpenPLC is an open-source PLC simulator that runs on Linux and Windows, supporting ladder logic, structured text, and Modbus/TCP communication.

Step‑by‑step guide:

1. Install OpenPLC on Ubuntu (or WSL2 for Windows):

   sudo apt update && sudo apt install git automake gcc make python3-pip
   git clone https://github.com/thiagoralves/OpenPLC_v3.git
   cd OpenPLC_v3
   ./install.sh
   

   Choose the “standard” installation when prompted. This installs the runtime, webserver, and Modbus server.

2. Start the OpenPLC runtime:

sudo ./start_openplc.sh

The web interface will be available at `http://localhost:8080`. Upload a simple ladder logic program (e.g., a motor start/stop circuit) to the PLC.

3. Capture traffic with Wireshark:

Install Wireshark and capture on the loopback interface (lo) or the Ethernet interface connected to your PLC.

sudo apt install wireshark -y
sudo wireshark

Apply a filter to isolate Modbus traffic: `modbus` or tcp.port == 502.

4. Baseline normal behavior:

Run the PLC for 10–15 minutes while capturing traffic. Document typical packet sizes, command frequencies, and register reads/writes. This baseline is critical for anomaly detection.

5. Simulate an anomaly:

Write a Python script using `pymodbus` to write a random value to a holding register every 5 seconds.

from pymodbus.client import ModbusTcpClient
import random, time
client = ModbusTcpClient('127.0.0.1', port=502)
client.connect()
while True:
client.write_register(0, random.randint(0, 65535))
time.sleep(5)

Observe the traffic spike in Wireshark and document the deviation from the baseline.

6. Build a detection rule:

Using Zeek (formerly Bro), create a custom script that alerts when write requests to register 0 exceed 10 per minute. This single project demonstrates networking, engineering awareness, threat detection, incident response, and technical communication.

1. Analyzing Modbus, S7, and DNP3 Traffic with Custom Wireshark Filters

Industrial protocols are often plaintext and lack authentication, making traffic analysis a cornerstone of OT security. Wireshark provides dissectors for Modbus, Siemens S7 (via s7comm), and DNP3, but effective analysis requires tailored display filters.

Step‑by‑step guide:

1. Install Wireshark and enable protocol dissectors:

On Windows, download from the official site. On Linux:

sudo apt install wireshark tshark

2. Modbus traffic analysis:

• Filter for all Modbus traffic: `modbus`
  – Filter for function code 3 (read holding registers): `modbus.func_code == 3`
  – Filter for writes to coil 0: `modbus.func_code == 5 && modbus.ref_num == 0`
  – Export the packet details to CSV for further analysis: `tshark -r capture.pcap -Y “modbus” -T fields -e frame.time -e modbus.func_code -e modbus.data > modbus_events.csv`

3. S7comm (Siemens S7) analysis:

• Filter for S7 communication: `s7comm`
  – Filter for read/write requests: `s7comm.param.func == 0x04` (read) or `0x05` (write)
• Identify CPU type and firmware: `s7comm.cpu_info`

4. DNP3 analysis:

• Filter for DNP3: `dnp3`
  – Filter for unsolicited responses (often indicate alarms): `dnp3.ctrl.uns == 1`
  – Map DNP3 object groups to physical processes (e.g., Group 30 for analog inputs).

5. Create a custom Wireshark profile:

Save your filters and columns (e.g., Time, Source, Destination, Protocol, Info, Function Code) as a new profile named “OT Security” for rapid incident analysis.

3. Mapping Incidents to MITRE ATT&CK for ICS

The MITRE ATT&CK for ICS framework provides a common taxonomy for understanding adversary behavior in industrial environments. Practicing incident mapping transforms raw alerts into actionable intelligence.

Step‑by‑step guide:

1. Familiarize yourself with the framework:

Visit the MITRE ATT&CK for ICS website and review tactics such as Initial Access, Execution, Persistence, and Impact. Pay special attention to techniques like T0818 (Modbus) and T0830 (Man-in-the-Middle).

2. Simulate a simple incident:

Using your virtual PLC lab, perform a rogue firmware upload (simulated by writing a malicious program via the web interface). Capture the network traffic and system logs.

3. Map the kill chain:

• Initial Access: Attacker gains access to the engineering workstation via phishing (simulated).
• Execution: Attacker uploads malicious ladder logic (T0872 – Change Operating Mode).
• Impact: Attacker sets motor speed to unsafe levels (T0831 – Manipulation of View).

4. Document the mapping:

Create a spreadsheet with columns: Time, Event, MITRE Technique ID, Detection Method, and Mitigation Control. This exercise directly supports threat-hunting and incident response planning.

5. Integrate with your SIEM:

Use the MITRE mappings to create correlation rules. For example, an alert for “Modbus write to coil” followed by “S7 CPU stop” could indicate a coordinated attack.

1. Building an OT SIEM and Threat-Hunting Plan with Elastic Stack

An OT-specific SIEM aggregates logs from PLCs, HMIs, firewalls, and network sensors. The Elastic Stack (Elasticsearch, Logstash, Kibana) is a popular open-source choice.

Step‑by‑step guide:

1. Install Elastic Stack:

On Ubuntu:

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
sudo apt install elasticsearch logstash kibana

2. Configure Logstash to ingest Modbus logs:

Create a pipeline that parses CSV exports from Wireshark or Syslog from your PLC.

input { file { path => "/var/log/modbus_events.csv" start_position => "beginning" } }
filter { csv { separator => "," columns => ["timestamp","func_code","data"] } }
output { elasticsearch { hosts => ["localhost:9200"] } }

3. Create a threat-hunting dashboard in Kibana:

Visualize:

• Number of Modbus writes per hour.
• Top source IPs communicating with the PLC.
• Unusual function codes (e.g., code 8 – diagnostics).

4. Develop a threat-hunting plan:

• Weekly hunts: Review all PLC program uploads/downloads.
• Monthly hunts: Correlate network anomalies with physical process changes (e.g., temperature spikes).
• Ad-hoc hunts: Respond to specific CVEs affecting your PLC models. Review industrial CVEs and advisories regularly.

5. Test your SIEM with a red-team exercise:

Simulate a credential brute-force against the engineering workstation and verify that your SIEM generates an alert.

5. Hardening Engineering Workstations and Creating SBOMs

Engineering workstations (EWS) are prime targets because they host configuration software and credentials. Hardening them and maintaining a Software Bill of Materials (SBOM) reduces the attack surface.

Step‑by‑step guide:

1. Apply Windows security baselines:

• Disable unnecessary services (e.g., Print Spooler, Remote Desktop if not needed).
• Enforce application whitelisting using Windows Defender Application Control (WDAC) or AppLocker.
• Enable Windows Defender Antivirus with cloud-delivered protection.

2. Linux EWS hardening (if applicable):

sudo ufw enable
sudo ufw allow from 192.168.1.0/24 to any port 22  Restrict SSH
sudo apt install fail2ban
sudo systemctl enable fail2ban

3. Create an SBOM:

Use tools like OWASP CycloneDX or Syft to generate a list of all software components.

syft dir:/path/to/ews/software -o json > sbom.json

This SBOM should be reviewed quarterly for known vulnerabilities (using tools like Grype).

4. Backup and recovery:

Regularly back up PLC programs, HMI projects, and historian databases. Test restoration procedures in a sandbox environment. Document the recovery time objective (RTO) for each asset.

5. Segment the EWS:

Place engineering workstations in a dedicated VLAN with strict firewall rules. Only allow RDP or VNC from trusted jump hosts.

6. Designing Tabletop Exercises and Incident Response Plans

Tabletop exercises are the most effective way to test your incident response plan without impacting live operations. They build muscle memory for the entire team.

Step‑by‑step guide:

1. Define scenarios:

• Scenario A: Ransomware on the HMI server.
• Scenario B: Malicious Modbus write causing a pump to overspeed.
• Scenario C: Insider threat modifying ladder logic.

2. Develop injects:

For each scenario, prepare injects such as: “At 10:05, the SOC receives an alert for unusual S7 program upload.” “At 10:15, the operator reports the motor is running hot.”

3. Facilitate the exercise:

• Assign roles: Incident Commander, SOC Analyst, Engineering Lead, Communications Lead.
• Use a whiteboard or collaborative tool to map the timeline.
• At each inject, ask: “What asset was protected? Which protocol or data source was involved? What could disrupt the physical process? Which evidence would support detection? Which control reduces risk without affecting operations?”

4. Document lessons learned:

Update your IR plan with new procedures, contact lists, and escalation paths. Share the findings with all stakeholders.

5. Repeat quarterly:

Rotate scenarios and injects to cover different threat actors (e.g., nation-state, hacktivist, insider). This continuous improvement cycle ensures your team remains ready.

What Undercode Say

• Key Takeaway 1: OT security is not simply IT security inside a factory. The consequences of a breach can extend beyond data loss to production disruption, equipment damage, and physical safety. Hands-on practice with virtual labs and protocol analysis is non-1egotiable for building effective defenses.

• Key Takeaway 2: The true value of practical projects lies not in completing all 50, but in documenting what each teaches you. A single project—capturing traffic, baselining behavior, simulating an anomaly, and building a detection—can demonstrate networking, engineering awareness, threat detection, incident response, and technical communication all at once.

Analysis:

Tolga Yıldız’s post highlights a critical gap in OT cybersecurity education: the over-reliance on theoretical knowledge. Industrial environments are complex, heterogeneous, and safety-critical, making simulation and hands-on labs indispensable. The 50 projects listed provide a structured curriculum that covers the entire lifecycle—from asset discovery and vulnerability assessment to detection, response, and recovery. What makes this approach particularly effective is the emphasis on documentation and reflection, which transforms technical exercises into lasting professional competencies. For practitioners, starting with a virtual PLC lab is the most accessible entry point, as it requires minimal hardware and can be run on a standard laptop. For organizations, adopting this project-based learning model can significantly accelerate the development of OT security talent while reducing the risk of misconfigurations in live environments. The inclusion of MITRE ATT&CK mapping and SIEM integration further aligns these exercises with industry-standard frameworks, ensuring that skills are transferable and defensible. Ultimately, this roadmap serves as both a personal development plan and a template for building internal training programs.

Prediction

• +1 Widespread adoption of virtual PLC labs and open-source OT security tools will democratize industrial cybersecurity training, enabling smaller organizations and individual practitioners to develop skills that were previously accessible only to large enterprises with physical testbeds.

• +1 The integration of AI-driven anomaly detection with traditional protocol analysis will accelerate threat-hunting capabilities, reducing mean time to detection (MTTD) in OT environments from days to minutes.

• -1 As more professionals gain hands-on experience with OT systems, the number of misconfigured lab environments exposed to the internet may increase, potentially creating new attack vectors if proper isolation practices are not followed.

• -1 The growing reliance on SBOMs and software composition analysis in OT may introduce friction with legacy systems that cannot be easily patched or upgraded, forcing organizations to choose between operational stability and security compliance.

• +1 Tabletop exercises and incident response drills will become mandatory for regulatory compliance in critical infrastructure sectors, driving demand for standardized exercise templates and inject libraries.

• +1 The convergence of IT and OT security teams will accelerate as practitioners gain cross-domain expertise through project-based learning, leading to more holistic defense strategies and faster incident resolution.

• -1 Without continuous investment in hands-on training and lab infrastructure, the cybersecurity skills gap in OT will widen, leaving many industrial assets vulnerable to sophisticated adversaries who actively practice their tradecraft in similar simulated environments.

▶️ Related Video (76% Match):

https://www.youtube.com/watch?v=5I5eXrHG5WE

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Iamtolgayildiz Otsecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky