Real-time monitoring identifies a vendor-distributed software update package that, upon execution, exhibits behavior inconsistent with the vendor's documented installation profile: spawning unexpected child processes, writing files outside the vendor's standard manifest, or loading unsigned Dynamic Link Libraries (DLLs). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| File Metadata (DC0059) | fim:hashcompare | installed binary hash does not match vendor-published checksum for claimed version |
| WinEventLog:Sysmon | Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Process creation and file creation correlation: vendor installer creates files outside vendor install manifest or spawns undocumented child process |
| Field | Description |
|---|---|
| VendorInstallManifest | Documented list of files/registry keys a legitimate vendor installer is expected to create. |
| VendorInstallProfile | Documented expected process behavior for a legitimate vendor installer, established through lab testing. |
Periodic or event-triggered integrity verification identifies field devices with firmware or configuration that differs from the vendor-published authorized baseline, detected by comparing device firmware hashes against the authorized firmware inventory, appearing immediately after a vendor-supplied update or hardware replacement. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Monitoring reality: this is an integrity/posture analytic, not a universal streaming field-device event; collection cadence depends on the vendor integrity interface, asset-management system, or acquisition workflow.
| Data Component | Name | Channel |
|---|---|---|
| Firmware Modification (DC0004) | assetinventory:FirmwareHash | post-update firmware hash does not match vendor-published checksum for the claimed version |
| Field | Description |
|---|---|
| VendorInstallManifest | Documented list of files/registry keys a legitimate vendor installer is expected to create. |
| VendorInstallProfile | Documented expected process behavior for a legitimate vendor installer, established through lab testing. |
Real-time monitoring identifies an Industrial Control System (ICS) vendor software package whose installation, via package manager, creates unexpected files or starts unrecognized services not documented in the vendor's package manifest. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| File Metadata (DC0059) | auditd:SYSCALL+PATH | Linux Audit SYSCALL+PATH records: package installation creates files outside the documented package manifest |
| Field | Description |
|---|---|
| VendorInstallManifest | Documented list of files/registry keys a legitimate vendor installer is expected to create. |
| VendorInstallProfile | Documented expected process behavior for a legitimate vendor installer, established through lab testing. |
Real-time monitoring identifies a network infrastructure device exhibiting behavioral anomalies (unexpected listening ports, new routing entries) after a vendor firmware update or hardware replacement, where the device firmware hash does not match the authorized inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | unexpected listening port or routing table change following firmware update event |
| Field | Description |
|---|---|
| VendorInstallManifest | Documented list of files/registry keys a legitimate vendor installer is expected to create. |
| VendorInstallProfile | Documented expected process behavior for a legitimate vendor installer, established through lab testing. |