Real-time monitoring identifies an internet-facing Industrial Control System (ICS) application server, web Human-Machine Interface (HMI), historian web interface, vendor remote access portal) process spawning an unexpected child process immediately following an inbound web request containing exploit-pattern content. Documented across multiple incidents involving internet-exposed ICS web interfaces. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Analyst implementation must limit predicates to fields actually retained by the web server/WAF (for example URI/path/query/header/status/source); request-body or payload signatures require WAF/DPI or request-body logging and must not be inferred from a basic access log.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | webserver:applog | Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface from unapproved source; request-body claims require WAF/DPI logging |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 with parent matching web/application server process and image matching shell/script interpreter within exploit-to-shell window of anomalous request |
| Field | Description |
|---|---|
| ApprovedClientCIDR | IP ranges from which legitimate access to the ICS web interface is expected. |
| ExploitPatternSignatures | Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products. |
| ExploitToShellWindow | Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request. |
Real-time monitoring identifies web server or Industrial Control System (ICS) application logs showing exploit-pattern requests to Industrial Control System (ICS) vendor web interfaces, followed by the web server daemon User Identifier (UID) spawning unexpected shell processes. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Analyst implementation must limit predicates to fields actually retained by the web server/WAF (for example URI/path/query/header/status/source); request-body or payload signatures require WAF/DPI or request-body logging and must not be inferred from a basic access log.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): unexpected process creation from web server daemon User Identifier (UID) spawning shell process |
| Application Log Content (DC0038) | webserver:applog | Web server/WAF access or request log: exploit-relevant URI/path/query/header/status pattern against ICS web interface; request-body claims require WAF/DPI logging |
| Field | Description |
|---|---|
| ApprovedClientCIDR | IP ranges from which legitimate access to the ICS web interface is expected. |
| ExploitPatternSignatures | Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products. |
| ExploitToShellWindow | Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request. |
Real-time monitoring identifies exploit-pattern HTTP/HTTPS traffic targeting an ICS DMZ application from a source or request pattern outside the approved application baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): inbound exploit-pattern traffic to Industrial Control Systems (ICS) Demilitarized Zone (DMZ) server followed by outbound connection from same Internet Protocol (IP) address to internal ICS network |
| Field | Description |
|---|---|
| ApprovedClientCIDR | IP ranges from which legitimate access to the ICS web interface is expected. |
| ExploitPatternSignatures | Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products. |
| ExploitToShellWindow | Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request. |
Real-time monitoring identifies Hypertext Transfer Protocol (HTTP) requests to an embedded device's management web interface containing exploit-pattern content (oversized parameters, directory traversal sequences) from a source not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | Hypertext Transfer Protocol (HTTP) request to device management web interface with exploit-pattern payload from source not in engineering workstation list |
| Field | Description |
|---|---|
| ApprovedClientCIDR | IP ranges from which legitimate access to the ICS web interface is expected. |
| ExploitPatternSignatures | Regex/signature set for known exploit payload patterns and published CVE-specific payload signatures for in-use ICS web products. |
| ExploitToShellWindow | Time window within which a child shell process spawned from the web server is considered connected to a preceding exploit-pattern request. |
| ID | Asset |
|---|---|
| A0001 | Workstation |
| A0008 | Application Server |
| A0011 | Virtual Private Network (VPN) Server |
| A0016 | Firewall |