Listen to this Post
You can’t secure what you can’t test. Most OT (Operational Technology) teams operate blindly—without labs, real data, or proper training. Labshock solves this by providing a Docker-based ICS/OT security lab that lets you:
– Simulate SCADA, PLCs, and EWS environments
– Capture real OT network traffic
– Test SIEM and IDS detections
– Train red & blue teams in realistic breach scenarios
You Should Know: How to Set Up and Use Labshock
1. Install Docker (Prerequisite)
On Linux (Debian/Ubuntu) sudo apt update sudo apt install docker.io sudo systemctl enable --now docker Verify installation docker --version
2. Deploy Labshock
Pull the Labshock Docker image (replace with actual image if available) docker pull labshock/ics-ot-lab Run the lab environment docker run -d --name labshock-ot -p 8080:80 labshock/ics-ot-lab
3. Simulate OT Attacks
Use Modbus, DNP3, or IEC 61850 traffic for testing:
Capture OT traffic with tcpdump sudo tcpdump -i eth0 'port 502' -w modbus_traffic.pcap Replay attacks using Scapy (Python) from scapy.all import<br /> pkt = Ether()/IP(dst="192.168.1.10")/TCP(dport=502)/ModbusADU() sendp(pkt, iface="eth0")
4. Test SIEM Rules
Example Sigma rule for ICS attack detection:
title: Suspicious Modbus Function Code description: Detects unusual Modbus function codes (e.g., 0x5B) logsource: product: modbus detection: function_code: - 0x5B - 0x5C condition: function_code
5. Validate Detection in Splunk/ELK
Query for malicious OT traffic in Splunk index=ot_traffic (Modbus.FunctionCode=0x5B OR DNP3.Function=12)
What Undercode Say
Labshock bridges the gap in ICS/OT security training by providing a safe, scalable lab without physical hardware. Key takeaways:
– Red Teams can simulate PLC ransomware attacks
– Blue Teams can fine-tune IDS rules for Modbus/DNP3 anomalies
– Universities can teach real-world OT threats
For hands-on learning:
- Watch Demo: YouTube
- GitHub: Star Labshock
Prediction
As OT-IT convergence grows, tools like Labshock will become essential for securing critical infrastructure against ransomware, zero-days, and nation-state attacks.
Expected Output
A fully functional ICS/OT lab running in Docker, with attack simulations, traffic analysis, and detection validation capabilities.
(Note: If Labshock’s Docker image or GitHub link is not public, replace with actual references when available.)
IT/Security Reporter URL:
Reported By: Zakharb You – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
