Real-time monitoring identifies a Universal Serial Bus (USB) storage device insertion event on an Industrial Control System (ICS) engineering or Human-Machine Interface (HMI) workstation where the device's hardware identifier (ID) is not in the authorized USB allowlist, immediately followed by process execution from the removable drive's path. Documented as the primary infection vector for Stuxnet, which specifically targeted air-gapped Siemens engineering environments via infected USB drives. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 from removable media path to Industrial Control Systems (ICS) engineering working directory |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 with image path on removable drive letter within Universal Serial Bus (USB) execution window of insertion event |
| Drive Creation (DC0042) | WinEventLog:System | EventCode=20001, 2003 not in authorized Universal Serial Bus (USB) allowlist on Industrial Control Systems (ICS) host |
| Field | Description |
|---|---|
| AuthorizedUSBAllowlist | Hardware ID inventory of USB storage devices authorized for use on ICS engineering and HMI workstations. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to perform file transfers to field devices. |
| USBExecutionWindow | Time window after device insertion/mount within which process execution is considered directly connected to the insertion event. |
Real-time monitoring identifies a mount event for removable storage media on an Industrial Control System (ICS) Linux asset, followed by execution of a binary from the mounted path within a short window. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; mount/udisksctl invoked to mount a removable block device on an ICS asset outside the approved removable-media workflow |
| auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve with path under /media/ or /mnt/ removable mount point within Universial Serial Bus (USB) execution window of mount event |
| Field | Description |
|---|---|
| AuthorizedUSBAllowlist | Hardware ID inventory of USB storage devices authorized for use on ICS engineering and HMI workstations. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to perform file transfers to field devices. |
| USBExecutionWindow | Time window after device insertion/mount within which process execution is considered directly connected to the insertion event. |
Real-time monitoring identifies a new device connecting to an Industrial Control System (ICS) network switch port that was previously unused or previously assigned to a different device Media Access Control (MAC) address immediately following physical access to the environment, with subsequent Industrial Control System (ICS) protocol traffic to field devices. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | new Media Access Control (MAC) address learned on a switch port previously unused or assigned to a different device, followed by Industrial Control Systems (ICS) protocol traffic to field devices |
| Field | Description |
|---|---|
| AuthorizedUSBAllowlist | Hardware ID inventory of USB storage devices authorized for use on ICS engineering and HMI workstations. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to perform file transfers to field devices. |
| USBExecutionWindow | Time window after device insertion/mount within which process execution is considered directly connected to the insertion event. |
Real-time monitoring identifies an Industrial Control System (ICS) protocol file-transfer service such as Distributed Network Protocol 3 (DNP3) File Transfer Object or Internet Electrotechnical Commision (IEC) 61850 file service being used to place files on a field device from a source not in the approved engineering workstation list, outside a scheduled maintenance window, where the transfer source is a device not previously enrolled. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | otids:ProtocolDecoder | Decoded OT/file-transfer transaction: transfer operation, source/destination, object/file identifier where exposed by the protocol, outside approved engineering/change window |
| Field | Description |
|---|---|
| AuthorizedUSBAllowlist | Hardware ID inventory of USB storage devices authorized for use on ICS engineering and HMI workstations. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to perform file transfers to field devices. |
| USBExecutionWindow | Time window after device insertion/mount within which process execution is considered directly connected to the insertion event. |