Configured Windows object-access monitoring identifies a write to an Industrial Control System (ICS) engineering project file by a process that is not the recognized vendor engineering software, or by the vendor engineering software immediately after loading a project file from an untrusted source. Documented mechanism in Havex (trojanized vendor software/installers distributed via compromised vendor websites). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Collection requirement: use Windows Security Event ID 4663 with Object Access auditing and SACLs on approved project repositories; Sysmon FileCreate events can corroborate writes/overwrites but do not report generic file-open/read activity.
| Data Component | Name | Channel |
|---|---|---|
| File Access (DC0055) | WinEventLog:Security | Windows Security Event ID 4663 (requires Object Access auditing/SACL): engineering process reads/opens project file from unapproved repository/removable-media/network-share path |
| File Metadata (DC0059) | WinEventLog:Sysmon | Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Engineering tool process opens project file from path not in approved project repository (removable media, email attachment cache, untrusted network share) |
| Field | Description |
|---|---|
| ApprovedProjectRepository | Documented, trusted source location(s) for project files. |
| AuthorizedEngineeringTools | Allowlist of vendor engineering software processes authorized to modify project files. |
| ProjectFileExtensions | File extensions used by ICS engineering project files for in-use vendor platforms. |
Real-time monitoring identifies a write to Industrial Control System (ICS) project file paths on a Linux engineering station from a User Identifier (UID) not associated with the ICS engineering tool, or from the tool after loading a file from a removable media or network path not in the approved software distribution list. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| File Metadata (DC0059) | auditd:SYSCALL+PATH | Linux Audit SYSCALL+PATH records: write to Industrial Control Systems (ICS) project file path by uid not in authorized engineering User Identifiers (UIDs) or from path not in approved project sources |
| Field | Description |
|---|---|
| ApprovedProjectRepository | Documented, trusted source location(s) for project files. |
| AuthorizedEngineeringTools | Allowlist of vendor engineering software processes authorized to modify project files. |
| ProjectFileExtensions | File extensions used by ICS engineering project files for in-use vendor platforms. |
| ID | Asset |
|---|---|
| A0001 | Workstation |