Monitor Windows Security Event ID 4663 on explicitly audited ICS data paths and correlate repeated ReadData/ListDirectory access across multiple sensitive files or directories by an account/process outside the approved engineering, backup, or application baseline. This requires Object Access auditing and SACLs on the monitored paths; Sysmon does not provide generic file-read telemetry. Alert when the bulk-read pattern occurs outside an approved backup/export window or is followed by staging, compression, or network transfer.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | WinEventLog:Sysmon | Sequential file reads across multiple Industrial Control Systems (ICS) data paths by image not in authorized ICS applications, exceeding bulk access threshold within a short window |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 of archive utility immediately following bulk file access pattern from same parent process tree |
| Field | Description |
|---|---|
| AuthorizedICSApplications | Allowlist of processes expected to perform legitimate bulk reads of ICS data. |
| BulkAccessThreshold | Number of distinct files read within the detection window that constitutes bulk collection. |
| ICSDataPaths | File system paths containing ICS configuration, project, and sensitive operational data. |
Real-time monitoring identifies a Linux process performing sequential reads across multiple ICS configuration or data paths by a UID outside approved backup, engineering, or vendor-application accounts. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): sequential reads across ICS data paths by uid not in authorized data access UIDs, followed by tar/zip invocation within a short window |
| Field | Description |
|---|---|
| AuthorizedICSApplications | Allowlist of processes expected to perform legitimate bulk reads of ICS data. |
| BulkAccessThreshold | Number of distinct files read within the detection window that constitutes bulk collection. |
| ICSDataPaths | File system paths containing ICS configuration, project, and sensitive operational data. |
Real-time monitoring identifies large outbound data transfers from Industrial Control System (ICS) server Internet Protocol (IP) addresses to destinations outside the approved ICS zone, following a pattern of bulk reads from engineering document stores or historian databases. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): sustained high-byte-count flow from Industrial Control Systems (ICS) server Internet Protocol (IP) address to destination outside ICS zone following bulk read activity |
| Field | Description |
|---|---|
| AuthorizedICSApplications | Allowlist of processes expected to perform legitimate bulk reads of ICS data. |
| BulkAccessThreshold | Number of distinct files read within the detection window that constitutes bulk collection. |
| ICSDataPaths | File system paths containing ICS configuration, project, and sensitive operational data. |
Real-time monitoring identifies Industrial Control System (ICS) protocol sessions that bulk-read configuration data, program blocks, or data record objects from field devices -- function code sequences retrieving entire data dictionaries rather than operational process values -- from a source with no prior history of configuration-read sessions. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | bulk read of configuration/data dictionary objects from source with no prior session history with this device |
| Field | Description |
|---|---|
| AuthorizedICSApplications | Allowlist of processes expected to perform legitimate bulk reads of ICS data. |
| BulkAccessThreshold | Number of distinct files read within the detection window that constitutes bulk collection. |
| ICSDataPaths | File system paths containing ICS configuration, project, and sensitive operational data. |
| ID | Asset |
|---|---|
| A0001 | Workstation |
| A0002 | Human-Machine Interface (HMI) |
| A0006 | Data Historian |
| A0007 | Control Server |
| A0008 | Application Server |
| A0012 | Jump Host |
| A0015 | Switch |
| A0016 | Firewall |