Real-time network monitoring identifies a sustained spike in malformed or high-volume Industrial Control System (ICS) protocol traffic directed at a single field device from a source not in the approved control server list, immediately followed by that device dropping out of the supervisory poll cycle. Documented precedent: Sandworm's Industroyer malware sent a crafted 18-byte proprietary User Datagram Protocol (UDP) packet to port 50000 on Siemens Protection Technology (SIPROTEC) relays (CVE-2015-5374), causing the device to hang and require a manual reboot. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection rate to device_ip exceeds Denial of Service (DoS) threshold per minute from single or distributed sources |
| Process History/Live Data (DC0107) | operationaldb:ProcessHistory | no new process value recorded for device_ip within 1.5x expected poll interval immediately following a flood alert |
| Network Traffic Content (DC0085) | NSM:Content | malformed Protocol Data Unit (PDU) rate to device_ip exceeds threshold within detection window from source not in approved Supervisory Control and Data Acquisition (SCADA) server list |
| Application Log Content (DC0038) | scada:applog | device communication-loss alarm generated within detection window of a corresponding network flood alert |
| Field | Description |
|---|---|
| CPUUtilizationThreshold | Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic. |
| DoSConnectionThreshold | Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate. |
| DoSDetectionWindow | Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes. |
| ExpectedPollInterval | Device-specific supervisory poll interval used to determine what counts as a process historian gap. |
| InterfaceErrorThreshold | Deviation from baseline interface error/discard rate, tuned against historical interface health data. |
| MalformedPacketThreshold | Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline. |
Real-time monitoring identifies an Industrial Control System (ICS) Linux service process (historian daemon, Open Platform Communications (OPC) gateway) being killed or crashing following a sustained high-rate inbound connection pattern recorded by network monitoring, correlated with daemon log entries indicating connection limit exhaustion or out-of-memory conditions. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.
| Data Component | Name | Channel |
|---|---|---|
| Process Termination (DC0033) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): Industrial Control Systems (ICS) service process terminated (SIGKILL/SIGSEGV) following high-rate inbound connections recorded in netflow within the same window |
| Application Log Content (DC0038) | syslog:daemon | Industrial Control Systems (ICS) daemon log entry indicating connection limit exceeded, out of memory, or watchdog timeout |
| Field | Description |
|---|---|
| CPUUtilizationThreshold | Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic. |
| DoSConnectionThreshold | Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate. |
| DoSDetectionWindow | Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes. |
| ExpectedPollInterval | Device-specific supervisory poll interval used to determine what counts as a process historian gap. |
| InterfaceErrorThreshold | Deviation from baseline interface error/discard rate, tuned against historical interface health data. |
| MalformedPacketThreshold | Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline. |
Real-time monitoring of switch/router interface counters identifies a sudden spike in discarded or errored packets on an Industrial Control System (ICS)-facing interface combined with Central Processing Unit (CPU) utilization climbing above baseline, correlated with loss of reachability to downstream field devices on that segment within the same window. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): flow volume to Industrial Control Systems (ICS) device subnet exceeds Denial of Service (DoS) flow threshold per minute |
| Application Log Content (DC0038) | networkdevice:snmp | ifInErrors or ifOutDiscards rate exceeds baseline combined with cpu5min exceeding utilization threshold |
| Field | Description |
|---|---|
| CPUUtilizationThreshold | Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic. |
| DoSConnectionThreshold | Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate. |
| DoSDetectionWindow | Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes. |
| ExpectedPollInterval | Device-specific supervisory poll interval used to determine what counts as a process historian gap. |
| InterfaceErrorThreshold | Deviation from baseline interface error/discard rate, tuned against historical interface health data. |
| MalformedPacketThreshold | Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline. |
Real-time monitoring identifies an Industrial Control System (ICS) Windows service (Open Platform Communications (OPC) server, historian, Supervisory Control and Data Acquisition (SCADA) polling service) consuming abnormal Central Processing Unit (CPU)/memory resources and becoming unresponsive following receipt of a high volume of connections to its application port, correlated with watchdog timeout or service crash events. OT operational-fidelity gate: Alert only when a device-specific traffic/resource threshold is exceeded and the same window shows service degradation, failed polling, device alarm/restart, resource exhaustion, or malformed/out-of-spec protocol behavior. Suppress planned load tests, maintenance, network convergence/failover, and known equipment faults after operator confirmation.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | Microsoft-Windows-Sysmon/Operational Event ID 3 NetworkConnect: inbound connection rate to Industrial Control Systems (ICS) application port exceeds threshold per minute from unexpected sources |
| Service Metadata (DC0041) | WinEventLog:System | EventCode=7034, 7036 for Industrial Control Systems (ICS) service within detection window of connection flood |
| Field | Description |
|---|---|
| CPUUtilizationThreshold | Network device CPU utilization percentage above which sustained load suggests packet-processing strain from flood traffic. |
| DoSConnectionThreshold | Connections-per-minute threshold exceeding normal SCADA polling cadence, derived from the device's actual configured scan rate. |
| DoSDetectionWindow | Time window over which flood rate and subsequent device silence are correlated, typically 1-5 minutes. |
| ExpectedPollInterval | Device-specific supervisory poll interval used to determine what counts as a process historian gap. |
| InterfaceErrorThreshold | Deviation from baseline interface error/discard rate, tuned against historical interface health data. |
| MalformedPacketThreshold | Number of malformed/out-of-spec PDUs within the detection window constituting a flood, set above the device's documented error-tolerance baseline. |