Detection of Native API

Real-time monitoring identifies a process making direct ioctl or mmap syscalls against Industrial Control System (ICS) hardware device files, bypassing the vendor's documented Application Programming Interface (API) layer, from a process not in the recognized ICS application list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.

Use an OT-capable protocol decoder to monitor SNMP requests/responses and identify access to vendor-internal or undocumented OIDs from sources outside the approved NMS inventory, especially SET operations or unusual walks against control-network infrastructure. This is network-protocol observation, not OS API execution; require decoded SNMP transaction content or equivalent packet inspection.

Real-time monitoring identifies Industrial Control System (ICS) protocol messages using vendor-specific or undocumented function codes that access device hardware registers directly rather than through the normal ICS application layer, from a source not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.