Real-time monitoring identifies a file written to an Industrial Control System (ICS) host from a remote network share, where the file has an executable or script extension, immediately followed by execution of that file from the same path. Documented in the PIPEDREAM toolkit's modular design, where components transfer files to compromised Programmable Logic Controllers (PLCs) and engineering workstations. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Share Access (DC0102) | WinEventLog:Security | Windows Security Event ID 5140/5145: EventCode=5145 for file write to Industrial Control Systems (ICS) host, source not in authorized file sources |
| File Creation (DC0039) | WinEventLog:Sysmon | EventCode=11 with executable/script extension from remote-sourced write operation |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 of the newly-created file within tool transfer window of its creation |
| Field | Description |
|---|---|
| AuthorizedFileSources | Allowlist of network shares/hosts authorized to write executable or script files to ICS Windows assets. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to perform file transfers to field devices. |
| SuspiciousFilePatterns | Filename/extension patterns inconsistent with the device's normal configuration exchange profile. |
| ToolTransferWindow | Time window after file creation within which execution is considered directly connected to the transfer event. |
Real-time monitoring identifies execution on an ICS Linux asset of an executable or script from a path commonly used for inbound file transfer or staging, by a UID outside the approved deployment/administration baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| File Creation (DC0039) | auditd:SYSCALL+PATH | Linux Audit SYSCALL+PATH records: file transfer (scp, sftp, rsync, etc.) placing executable on Industrial Control Systems (ICS) Linux asset, followed by execve of the transferred file within tool transfer window |
| Field | Description |
|---|---|
| AuthorizedFileSources | Allowlist of network shares/hosts authorized to write executable or script files to ICS Windows assets. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to perform file transfers to field devices. |
| SuspiciousFilePatterns | Filename/extension patterns inconsistent with the device's normal configuration exchange profile. |
| ToolTransferWindow | Time window after file creation within which execution is considered directly connected to the transfer event. |
Real-time monitoring identifies an Industrial Control System (ICS) protocol file-transfer service placing a file on a field device from a source not in the approved engineering workstation list, where the transferred filename pattern matches firmware images or executable payloads inconsistent with the device's normal data exchange profile. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | otids:ProtocolDecoder | Decoded DNP3/IEC 61850 file-transfer transaction: source/destination and file/object identifier where exposed; correlate with approved engineering source and change window |
| Field | Description |
|---|---|
| AuthorizedFileSources | Allowlist of network shares/hosts authorized to write executable or script files to ICS Windows assets. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to perform file transfers to field devices. |
| SuspiciousFilePatterns | Filename/extension patterns inconsistent with the device's normal configuration exchange profile. |
| ToolTransferWindow | Time window after file creation within which execution is considered directly connected to the transfer event. |
| ID | Asset |
|---|---|
| A0001 | Workstation |
| A0007 | Control Server |
| A0008 | Application Server |
| A0011 | Virtual Private Network (VPN) Server |
| A0012 | Jump Host |
| A0013 | Field I/O |