Real-time monitoring identifies a field device loading a modified autorun image (boot read-only memory, bootloader firmware) detected by a discrepancy between the device's declared firmware hash and the authorized firmware inventory hash, with post-reboot device behavior diverging from expected (unexpected protocols active, unanticipated network connections). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Firmware Modification (DC0004) | assetinventory:FirmwareHash | device firmware hash does not match authorized firmware inventory following a reboot event |
| Network Connection Creation (DC0082) | NSM:Connections | device establishes new network connections or activates protocols not seen in pre-reboot baseline |
| Field | Description |
|---|---|
| AuthorizedICSSoftwareInventory | Inventory of binaries legitimately authorized to be referenced by autorun/startup mechanisms on ICS hosts. |
| AutorunModificationWindow | Time window correlating removable media insertion with a subsequent autorun configuration change. |
Real-time monitoring identifies modification of udev rules or autofs configuration that triggers script execution on removable media mount, where the triggered script path is not in the authorized Industrial Control System (ICS) software inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | auditd:SYSCALL+PATH | Linux Audit SYSCALL+PATH records: PATH record shows modification of udev/autofs configuration that references an executable or script outside the authorized ICS software inventory |
| Field | Description |
|---|---|
| AuthorizedICSSoftwareInventory | Inventory of binaries legitimately authorized to be referenced by autorun/startup mechanisms on ICS hosts. |
| AutorunModificationWindow | Time window correlating removable media insertion with a subsequent autorun configuration change. |
Real-time monitoring identifies a registry write to Windows autorun keys or an AutoPlay/AutoRun configuration change referencing a binary path that is not part of the authorized Industrial Control System (ICS) software inventory, particularly in combination with removable media insertion. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | WinEventLog:Security | Windows Security Event ID 4663 (requires Object Access auditing and SACL on monitored paths): repeated ReadData/ListDirectory access across ICS data paths by an unapproved process/account |
| Drive Creation (DC0042) | WinEventLog:System | EventCode=20001 correlated with autorun registry modification within autorun modification window |
| Field | Description |
|---|---|
| AuthorizedICSSoftwareInventory | Inventory of binaries legitimately authorized to be referenced by autorun/startup mechanisms on ICS hosts. |
| AutorunModificationWindow | Time window correlating removable media insertion with a subsequent autorun configuration change. |
| ID | Asset |
|---|---|
| A0001 | Workstation |
| A0002 | Human-Machine Interface (HMI) |
| A0006 | Data Historian |
| A0007 | Control Server |
| A0008 | Application Server |
| A0012 | Jump Host |