Real-time monitoring identifies a service control command targeting a critical Industrial Control System (ICS) services such as Open Platform Communications (OPC) server, historian, Supervisory Control and Data Acquisition (SCADA) polling from an account not in the authorized service administration role, without a preceding change-control ticket, immediately followed by the service transitioning to Stopped state. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 sc.exe/net.exe invocation targeting a critical ICS service from an account outside the authorized service-administration set |
| Service Metadata (DC0041) | WinEventLog:System | EventCode=7036 critical Industrial Control Systems (ICS) service transitions to Stopped without preceding change ticket reference |
| Field | Description |
|---|---|
| AuthorizedServiceAdmins | Accounts authorized to stop/start critical ICS services. |
| BulkRestartTimeWindow | Time window within which multiple device restarts are considered a coordinated event. |
| CriticalICSServiceList | List of Windows services whose stoppage constitutes a high-impact event. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue device restart commands. |
Real-time monitoring identifies systemctl stop or kill commands targeting Industrial Control System (ICS) service processes on Linux assets, from a User Identifier (UID) that is not the ICS service owner or an authorized system administrator. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; systemctl/kill command targets a critical ICS service from a UID not in the authorized service-administration set |
| Field | Description |
|---|---|
| AuthorizedServiceAdmins | Accounts authorized to stop/start critical ICS services. |
| BulkRestartTimeWindow | Time window within which multiple device restarts are considered a coordinated event. |
| CriticalICSServiceList | List of Windows services whose stoppage constitutes a high-impact event. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue device restart commands. |
Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to service-stop Object Identifiers (OIDs) or Command Line Interface (CLI) commands stopping routing/switching processes critical to Industrial Control System (ICS) communication, from sources not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | Simple Network Management Protocol (SNMP) SET to service stop Object Identifier (OID) or Command Line Interface (CLI) command stopping critical service from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| AuthorizedServiceAdmins | Accounts authorized to stop/start critical ICS services. |
| BulkRestartTimeWindow | Time window within which multiple device restarts are considered a coordinated event. |
| CriticalICSServiceList | List of Windows services whose stoppage constitutes a high-impact event. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue device restart commands. |
Real-time monitoring identifies an Industrial Control System (ICS) protocol restart command directed at a field device from a source not in the approved engineering workstation list, where multiple devices receive restart commands within a short window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | restart/reset service from source not in engineering workstation list, with more than one device receiving the command within bulk restart time window |
| Field | Description |
|---|---|
| AuthorizedServiceAdmins | Accounts authorized to stop/start critical ICS services. |
| BulkRestartTimeWindow | Time window within which multiple device restarts are considered a coordinated event. |
| CriticalICSServiceList | List of Windows services whose stoppage constitutes a high-impact event. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue device restart commands. |