Real-time monitoring identifies a Linux process with both a listening socket on an Industrial Control System (ICS) protocol port and an outbound connection to a non-ICS destination, or iptables DNAT/REDIRECT rules added on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline |
| Network Connection Creation (DC0082) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): bind/listen/connect syscalls show one process accepting ICS-protocol connections while also initiating an outbound connection to a non-ICS destination |
| Field | Description |
|---|---|
| RelayCorrelationWindow | Time window and byte-count proportionality tolerance used to determine whether concurrent flows represent a relay pattern. |
Real-time monitoring identifies a host simultaneously maintaining an inbound connection on an Industrial Control System (ICS) protocol port and an outbound connection to a destination outside the ICS network zone, detectable as correlated dual flows with matching timing and approximate byte-count proportionality. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): host maintains simultaneous flows to device subnet and external destination with timing/byte-count correlation indicating relay |
| Field | Description |
|---|---|
| RelayCorrelationWindow | Time window and byte-count proportionality tolerance used to determine whether concurrent flows represent a relay pattern. |
Real-time monitoring identifies a field device or serial gateway receiving Industrial Control System (ICS) protocol traffic relayed through an intermediate host, identifiable by protocol-level timing anomalies or L2 source address changes where the device Internet Protocol (IP) address responds from a Media Access Control (MAC) address different from its enrolled hardware address. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | protocol-level latency inconsistent with direct communication, or Media Access Control (MAC)/Internet Protocol (IP) address binding change for device_ip |
| Field | Description |
|---|---|
| RelayCorrelationWindow | Time window and byte-count proportionality tolerance used to determine whether concurrent flows represent a relay pattern. |
Real-time monitoring identifies a Windows process holding simultaneous connections to both the field device subnet and an external destination, combined with proxy-tool process creation. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 same process holding connections to both device subnet and external Internet Protocol (IP) address simultaneously |
| Service Creation (DC0060) | WinEventLog:System | EventCode=7045 enabling Transmission Control Protocol (TCP) port forwarding on Industrial Control Systems (ICS) protocol port not in known ICS services |
| Field | Description |
|---|---|
| RelayCorrelationWindow | Time window and byte-count proportionality tolerance used to determine whether concurrent flows represent a relay pattern. |