Real-time monitoring identifies successful authentication to an Industrial Control System (ICS) application such as a Human-Machine Interface (HMI), historian, Supervisory Control and Data Acquisition (SCADA) server using credentials matching known default vendor passwords, from a logon source not associated with any authorized user. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | WinEventLog:Security | Windows Security Event ID 4624/4625: EventCode=4624 for account matching default vendor credential list from source not in approved host list |
| Field | Description |
|---|---|
| DefaultVendorCredentialList | Documented default username/password combinations for all device models in the environment. |
| EngineeringWorkstationList | IP allowlist of legitimate authentication sources. |
Real-time monitoring identifies authentication attempts against Industrial Control System (ICS) network device management interfaces using well-known default vendor credentials from source Internet Protocol (IP) addresses not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet range. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| User Account Authentication (DC0002) | networkdevice:syslog | Device authentication/audit log: successful authentication using a vendor-default or prohibited account from a non-approved management source |
| Field | Description |
|---|---|
| DefaultVendorCredentialList | Documented default username/password combinations for all device models in the environment. |
| EngineeringWorkstationList | IP allowlist of legitimate authentication sources. |
Real-time monitoring identifies successful authentication to a field device using credentials matching documented vendor-default values, from a source not in the approved access list. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | authentication success using credential matching default vendor credential list from source not in engineering workstation list |
| Field | Description |
|---|---|
| DefaultVendorCredentialList | Documented default username/password combinations for all device models in the environment. |
| EngineeringWorkstationList | IP allowlist of legitimate authentication sources. |
Real-time monitoring identifies successful Secure Shell (SSH) or application authentication using credentials matching known default vendor passwords on Industrial Control System (ICS) Linux assets. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | syslog:auth | sshd Accepted for username matching default vendor credential list from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| DefaultVendorCredentialList | Documented default username/password combinations for all device models in the environment. |
| EngineeringWorkstationList | IP allowlist of legitimate authentication sources. |