Real-time monitoring identifies a previously unseen wireless device identity joining or authenticating to an ICS wireless segment—such as Wi-Fi/802.1X, WirelessHART, ISA100.11a, or a vendor radio mesh—when its MAC/EUI, certificate, or device identifier is absent from the approved wireless asset inventory. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): traffic from newly-authenticated device to Industrial Control System (ICS) application server within onboard window of association |
| Logon Session Creation (DC0067) | wireless:radius | Extensible Authentication Protocol (EAP) authentication success for device Media Access Control (MAC)/certificate not in approved wireless device inventory |
| Field | Description |
|---|---|
| ApprovedWirelessDeviceInventory | MAC/certificate inventory of devices authorized to associate with ICS wireless infrastructure. |
| DesignatedWirelessManagementStations | Hosts authorized to legitimately enable wireless monitor mode for diagnostics. |
| WirelessOnboardWindow | Time window after wireless association within which ICS-directed traffic is considered part of the same onboarding event. |
Real-time monitoring identifies a process executing iwconfig or ip link set
| Data Component | Name | Channel |
|---|---|---|
| Process Metadata (DC0034) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor/promiscuous mode outside change management window |
| Field | Description |
|---|---|
| ApprovedWirelessDeviceInventory | MAC/certificate inventory of devices authorized to associate with ICS wireless infrastructure. |
| DesignatedWirelessManagementStations | Hosts authorized to legitimately enable wireless monitor mode for diagnostics. |
| WirelessOnboardWindow | Time window after wireless association within which ICS-directed traffic is considered part of the same onboarding event. |
Real-time monitoring identifies a Windows process enabling promiscuous or monitor mode on a wireless adapter (netsh wlan, WinPcap/Npcap driver load, etc.) on an Industrial Control System (ICS) workstation that is not a designated wireless management station, indicating preparation for wireless interception consistent with this technique's reconnaissance phase. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Driver Load (DC0079) | WinEventLog:Sysmon | EventCode=6 for wireless capture driver on host not in designated wireless management station list |
| Field | Description |
|---|---|
| ApprovedWirelessDeviceInventory | MAC/certificate inventory of devices authorized to associate with ICS wireless infrastructure. |
| DesignatedWirelessManagementStations | Hosts authorized to legitimately enable wireless monitor mode for diagnostics. |
| WirelessOnboardWindow | Time window after wireless association within which ICS-directed traffic is considered part of the same onboarding event. |
| ID | Asset |
|---|---|
| A0001 | Workstation |
| A0013 | Field I/O |