Real-time monitoring identifies an unrecognized process on an ICS Linux host loading an ICS/vendor shared library that is normally restricted to approved control or engineering applications. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| OS API Execution (DC0021) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): dlopen() of Industrial Control Systems (ICS) vendor shared library by process not in authorized ICS applications, followed by write-capable network connection to device subnet |
| Field | Description |
|---|---|
| ApprovedApplicationList | Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests. |
| ApprovedOPCClients | Allowlist of OPC client application identities authorized to invoke write/control methods. |
| AuthorizedICSApplications | Allowlist of process executables permitted to load ICS vendor automation API libraries. |
Monitor OPC UA server audit events for state-changing Write or Method service invocations and compare ClientUserId, ClientApplicationUri, SourceNode/MethodId, status, and arguments with the approved client/method baseline. For servers that support auditing, AuditWriteUpdateEventType and AuditUpdateMethodEventType provide an analyst-visible record of writes and state-changing method calls. Alert on successful or attempted control operations from unapproved clients/users or against methods/nodes outside the documented engineering workflow; do not describe this as Windows OS API telemetry.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | opcua:AuditEvent | OPC UA AuditUpdateMethodEventType/AuditWriteUpdateEventType: ClientUserId, ClientApplicationUri, SourceNode/MethodId, Status and arguments for a state-changing method/write |
| Module Load (DC0016) | WinEventLog:Sysmon | EventCode=7 where an ICS/vendor DLL is loaded by an image outside the authorized ICS application baseline |
| Field | Description |
|---|---|
| ApprovedApplicationList | Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests. |
| ApprovedOPCClients | Allowlist of OPC client application identities authorized to invoke write/control methods. |
| AuthorizedICSApplications | Allowlist of process executables permitted to load ICS vendor automation API libraries. |
Real-time monitoring identifies Open Platform Communications (OPC) Unified Architecture (UA) method invocations or International Electrotechnical Commission (IEC) 61850 Abstract Common Services Interface (ACSI) service requests arriving at a field device from a client identity not in the approved application allowlist, where the invoked method is a write or control operation rather than read/subscribe. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | write/control method invocation from client identity not in approved application list |
| Field | Description |
|---|---|
| ApprovedApplicationList | Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests. |
| ApprovedOPCClients | Allowlist of OPC client application identities authorized to invoke write/control methods. |
| AuthorizedICSApplications | Allowlist of process executables permitted to load ICS vendor automation API libraries. |
Real-time monitoring identifies network traffic to Industrial Control System (ICS) Application Programming Interface (API) ports such as 4840 used in the Open Platform Communications (OPC) Unified Architecture (UA) or vendor-specific API ports from source Internet Protocol (IP) addresses not in the approved application client list, where the traffic pattern is consistent with write/control method invocations rather than subscription/read traffic. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | zeek:ssl | Zeek ssl.log/TLS metadata: server_name (SNI), certificate chain/issuer/subject where available; compare with approved vendor domains/certificates |
| Field | Description |
|---|---|
| ApprovedApplicationList | Allowlist of application identities authorized to issue OPC UA or IEC 61850 write/control service requests. |
| ApprovedOPCClients | Allowlist of OPC client application identities authorized to invoke write/control methods. |
| AuthorizedICSApplications | Allowlist of process executables permitted to load ICS vendor automation API libraries. |