Real-time monitoring identifies an Industrial Control System (ICS) protocol write to a controller's task/organization-block configuration from a source not in the approved engineering workstation list, correlated against post-modification cycle timing deviation. Documented precedent: Stuxnet infected Siemens OB1 (main execution cycle block) so its malicious payload ran every cycle, and infected OB35 (watchdog/interrupt block) to suppress error reporting. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Software (DC0111) | assetinventory:ProgramDiff | current task-to-block assignment table differs from last known-good baseline without corresponding change ticket |
| Network Traffic Content (DC0085) | NSM:Content | task/organization-block modification service from source not in engineering workstation list outside change control window |
| Device Alarm (DC0108) | device:VendorLog | measured scan cycle time or interrupt response latency deviates from baseline cycle time by more than cycle timing deviation threshold following a task configuration change |
| Field | Description |
|---|---|
| BaselineCycleTime | Measured normal scan cycle time for the specific controller and program. |
| ChangeControlWindow | Scheduled maintenance periods during which task reconfiguration is authorized. |
| CycleTimingDeviationThreshold | Percentage or absolute deviation from baseline cycle time indicating a task reassignment. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to modify controller task configuration. |