Real-time monitoring identifies an Industrial Control System (ICS) protocol session consistent with a program download to a field device from a source not in the approved engineering workstation list, correlated with a device mode-change alarm transitioning to PROGRAM/STOP immediately preceding the transfer. Documented in Stuxnet (code/data block download to alter programmable logic controller behavior) and Triton (TriStation protocol program download to the Triconex Safety Instrumented System). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Asset Inventory (DC0110) | assetinventory:ProgramHash | post-transfer program hash does not match last authorized program baseline |
| Device Alarm (DC0108) | operationaldb:AlarmEvent | device_ip transitions to PROGRAM/STOP mode without operator_ack and without corresponding open change ticket reference |
| Network Traffic Content (DC0085) | NSM:Content | S7comm Download Block / Common Industrial Protocol (CIP) Download Program / Distributed Network Protocol (DNP3) program file transfer to device_ip from source not in engineering workstation list within mode change to download window of mode-change event |
| Application Log Content (DC0038) | engineeringworkstation:ApplicationLog | program download session logged without corresponding change ticket reference |
| Field | Description |
|---|---|
| ChangeControlWindow | Scheduled maintenance periods during which program downloads are authorized. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to perform program downloads. |
| ModeChangeToDownloadWindow | Time window within which a mode-change event and subsequent download session are considered the same engineering action. |
| ProgramDownloadSizeThreshold | Minimum byte count distinguishing a full program download from routine traffic. |