Real-time monitoring identifies execution of network discovery tools (nmap, PLCScan, redpoint NSE scripts) or Industrial Control System (ICS)-specific scanners from an Industrial Control System (ICS) Windows host, from a process not associated with a recognized network management or engineering tool. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 of network discovery tool (nmap, PLCScan) from process not in authorized network tools list |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate engineering and SCADA systems. |
| AuthorizedNetworkTools | Allowlist of network management/diagnostic tools authorized for use on ICS hosts. |
| DiscoveryTimeWindow | Time window within which sequential connections across the address range are considered a single discovery sweep event. |
Real-time monitoring identifies execution of network discovery tools on an Industrial Control System (ICS) Linux asset by a User Identifier (UID) that does not normally perform network scanning. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of network discovery tool (nmap, arp-scan, PLCScan) by User Identifier (UID) not in authorized net admin UIDs |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate engineering and SCADA systems. |
| AuthorizedNetworkTools | Allowlist of network management/diagnostic tools authorized for use on ICS hosts. |
| DiscoveryTimeWindow | Time window within which sequential connections across the address range are considered a single discovery sweep event. |
Real-time network monitoring identifies a source generating Industrial Control System (ICS) discovery broadcasts or sequential connection attempts across the full IP range of a device subnet, from a source not in the approved engineering/Supervisory Control and Data Acquisition (SCADA) inventory. Documented in the PIPEDREAM/INCONTROLLER toolset's CODECALL module for EtherNet/IP device discovery. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates flows to every IP in device subnet in sequential order within discovery time window |
| Network Traffic Content (DC0085) | NSM:Content | EtherNet/IP ListIdentity broadcast or sequential Industrial Control System (ICS) protocol connection attempts across Internet Protocol (IP) range from source not in approved Supervisory Control and Data Acqusition (SCADA) servers |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate engineering and SCADA systems. |
| AuthorizedNetworkTools | Allowlist of network management/diagnostic tools authorized for use on ICS hosts. |
| DiscoveryTimeWindow | Time window within which sequential connections across the address range are considered a single discovery sweep event. |
Real-time monitoring identifies Internet Control Message Protocol (ICMP) echo sweeps, Address Resolution Protocol (ARP) broadcast floods, or Industrial Control System (ICS)-specific discovery protocol packets from a host generating traffic to all IPs in a subnet in sequential order, a sweep pattern distinct from normal operational traffic to known device Internet Protocol (IP) addresses only. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): Internet Control Message Protocol (ICMP) echo requests or Address Resolution Protocol (ARP) broadcasts to all Internet Protocol (IP) addresses in subnet sequentially from single source within discovery time window |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate engineering and SCADA systems. |
| AuthorizedNetworkTools | Allowlist of network management/diagnostic tools authorized for use on ICS hosts. |
| DiscoveryTimeWindow | Time window within which sequential connections across the address range are considered a single discovery sweep event. |