Real-time network monitoring identifies a source issuing write commands to the same Input/Output (I/O) point or register address at a rate significantly exceeding the device's configured scan cycle. The write rate itself is the signature, with source identity retained as corroborating context; treat the rate deviation as suspicious only after excluding tuning, commissioning, failover, and fault-recovery activity. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process History/Live Data (DC0107) | operationaldb:ProcessHistory | I/O point value oscillates or changes state at frequency exceeding max normal state change rate, inconsistent with physical process response time |
| Network Traffic Content (DC0085) | NSM:Content | write function code to same register address at rate exceeding max write rate per point within brute force detection window |
| Application Log Content (DC0038) | scada:applog | write Application Programming Interface (API) call queue depth or throughput to a single point exceeds max write queue depth |
| Field | Description |
|---|---|
| BruteForceDetectionWindow | Time window over which write rate is measured for threshold comparison. |
| MaxNormalStateChangeRate | Maximum rate at which the physical process value is expected to legitimately change state. |
| MaxWriteQueueDepth | Maximum legitimate write queue depth for SCADA/DCS write operations to a single point. |
| MaxWriteRatePerPoint | Maximum legitimate write rate to a single I/O point, derived from the device's configured scan cycle and physical process response time. |
Real-time monitoring identifies an Industrial Control System (ICS) Linux service process making write Application Programming Interface (API) calls to field device Input/Output (I/O) at a rate exceeding the configured scan rate, from a User Identifier (UID) associated with the Supervisory Control and Data Acquisition (SCADA)/control application but exhibiting anomalous write volume. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): write Application Programming Interface (API) invocation rate to single Input/Output (I/O) point from Industrial Control Systems (ICS) service User Identifier (UID) exceeds max write rate per point |
| Field | Description |
|---|---|
| BruteForceDetectionWindow | Time window over which write rate is measured for threshold comparison. |
| MaxNormalStateChangeRate | Maximum rate at which the physical process value is expected to legitimately change state. |
| MaxWriteQueueDepth | Maximum legitimate write queue depth for SCADA/DCS write operations to a single point. |
| MaxWriteRatePerPoint | Maximum legitimate write rate to a single I/O point, derived from the device's configured scan cycle and physical process response time. |
Real-time monitoring identifies an Industrial Control System (ICS) Windows application such as a Supervisory Control and Data Acquisition (SCADA) server or Distributed Control System (DCS) interface generating anomalously high-frequency write Application Programming Interface (API) calls to field devices, exceeding the configured scan rate baseline for that point. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | opc:applog | Open Platform Communications Data Access (OPC DA) write queue depth or write throughput to a single point exceeds configured baseline by a significant margin |
| Field | Description |
|---|---|
| BruteForceDetectionWindow | Time window over which write rate is measured for threshold comparison. |
| MaxNormalStateChangeRate | Maximum rate at which the physical process value is expected to legitimately change state. |
| MaxWriteQueueDepth | Maximum legitimate write queue depth for SCADA/DCS write operations to a single point. |
| MaxWriteRatePerPoint | Maximum legitimate write rate to a single I/O point, derived from the device's configured scan cycle and physical process response time. |