Real-time monitoring identifies indirect evidence of passive RF capture on Industrial Control System (ICS) wireless frequencies -- an unassociated device's RF signature detected without a completed association sequence, or a known device's Media Access Control (MAC) address detected from a location/signal strength inconsistent with its registered installation point. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | wireless:spectrum | Radio Frequency (RF) signal detected on Industrial Control Systems (ICS) wireless frequencies from Media Access Control (MAC) address not in approved wireless device inventory without completed association sequence |
| Field | Description |
|---|---|
| ApprovedWirelessDeviceInventory | MAC/identity inventory of all devices authorized on the ICS wireless segment. |
| DesignatedWirelessManagementStations | Hosts authorized to legitimately enable wireless capture for diagnostics. |
Real-time monitoring identifies a process on an Industrial Control System (ICS) Linux asset setting a wireless interface to monitor mode via iwconfig or netlink calls, from a User Identifier (UID) not associated with documented wireless diagnostics. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Process Metadata (DC0034) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of wireless configuration utility setting monitor mode on Industrial Control Systems (ICS) Linux asset by User Identifier (UID) not in authorized wireless admin UIDs |
| Field | Description |
|---|---|
| ApprovedWirelessDeviceInventory | MAC/identity inventory of all devices authorized on the ICS wireless segment. |
| DesignatedWirelessManagementStations | Hosts authorized to legitimately enable wireless capture for diagnostics. |
Real-time monitoring identifies a Windows process enabling promiscuous or monitor mode on a wireless adapter on an Industrial Control System (ICS) workstation that is not a designated wireless management station, indicating preparation for wireless interception. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Driver Load (DC0079) | WinEventLog:Sysmon | EventCode=6 for wireless capture driver on host not in designated wireless management station list |
| Field | Description |
|---|---|
| ApprovedWirelessDeviceInventory | MAC/identity inventory of all devices authorized on the ICS wireless segment. |
| DesignatedWirelessManagementStations | Hosts authorized to legitimately enable wireless capture for diagnostics. |
| ID | Asset |
|---|---|
| A0001 | Workstation |
| A0013 | Field I/O |