Detection of Detect Operating Mode

Real-time monitoring identifies Industrial Control System (ICS) protocol requests specifically targeting mode/status registers from a source not in the approved control server or engineering workstation list, where the request pattern is narrowly focused on mode/state data rather than broader process value polling. Directly documented in the Triton attack chain's 'Get Control Program Status' request. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.