Detection of Masquerading

Real-time monitoring identifies a process whose executable name matches a known Industrial Control System (ICS) service daemon but whose execution path falls outside the documented vendor installation directories, or whose binary hash does not match the package manager's recorded checksum for that package. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies an ICS device presenting protocol identity attributes (for example vendor, product, model, or capability identifiers) that conflict with the identity and capabilities recorded for that network address/device in the authorized asset inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Real-time monitoring identifies traffic on an Industrial Control System (ICS) protocol port (e.g., 502, 20000, 44818, etc.) with payload content that does not conform to the expected protocol structure for that port, suggesting non-ICS traffic tunneled over ICS port numbers to evade port-based filtering or blend with expected traffic patterns. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.