Real-time monitoring identifies a network-accessible service process (lsass.exe, a vendor remote management service) spawning an unexpected child process or exhibiting cross-process memory access patterns immediately following inbound connection from an unusual source. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Process Access (DC0035) | WinEventLog:Sysmon | EventCode=10 where SourceImage outside the approved ICS vendor/process baseline accesses TargetImage associated with an ICS application or service |
| Field | Description |
|---|---|
| ApprovedClientCIDR | IP ranges from which legitimate connections to network-facing ICS services are expected. |
Real-time monitoring identifies an ICS Linux network-facing service spawning a shell, interpreter, or other child process outside the expected service-child baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; shell/interpreter process is spawned by an ICS network-facing service or other unexpected parent process |
| Field | Description |
|---|---|
| ApprovedClientCIDR | IP ranges from which legitimate connections to network-facing ICS services are expected. |
Real-time monitoring identifies malformed, oversized, or out-of-spec ICS protocol messages sent to an embedded field device from an unexpected or unauthorized source. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | malformed or oversized Industrial Control System (ICS) protocol message from unexpected source followed by device behavioral anomaly (reboot, mode change) within a short window |
| Field | Description |
|---|---|
| ApprovedClientCIDR | IP ranges from which legitimate connections to network-facing ICS services are expected. |
Real-time monitoring identifies exploit-pattern ICS/network traffic, including malformed packets, out-of-spec function codes, or overflow-sized payloads, targeting ICS servers or field devices from unexpected sources. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | zeek:conn | exploit-pattern traffic to Industrial Control Systems (ICS) server/device Internet Protocol (IP) from unexpected source, followed by behavioral anomaly within a short window |
| Field | Description |
|---|---|
| ApprovedClientCIDR | IP ranges from which legitimate connections to network-facing ICS services are expected. |