Real-time monitoring identifies Industrial Control System (ICS) protocol commands changing device-level credentials or access codes from a source not in the approved security administration list, where the device subsequently rejects connections from legitimate control system components. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | credential/access code change command from source not in approved security admin list |
| Field | Description |
|---|---|
| AuthorizedCredentialAdmins | Accounts authorized to change credentials for ICS service and operator accounts. |
| CredentialChangeImpactWindow | Time window after a credential change within which a service authentication failure is considered directly connected. |
| CredentialRotationSchedule | Documented schedule for routine credential rotation. |
Real-time monitoring identifies passwd/chpasswd modification of Industrial Control System (ICS) service account credentials by a User Identifier (UID) that is not a designated system administrator, outside a formal credential rotation procedure. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; passwd/chpasswd targets an ICS service account outside the approved credential-rotation workflow |
| Field | Description |
|---|---|
| AuthorizedCredentialAdmins | Accounts authorized to change credentials for ICS service and operator accounts. |
| CredentialChangeImpactWindow | Time window after a credential change within which a service authentication failure is considered directly connected. |
| CredentialRotationSchedule | Documented schedule for routine credential rotation. |
Real-time monitoring identifies network device credential changes such as Authentication, Authorization, and Accounting (AAA) password modification or Simple Network Management Protocol (SNMP) community string modification from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, corroborated by syslog showing authentication failures from legitimate NMS systems following the change. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | AAA/Simple Network Management Protocol (SNMP) credential change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, followed by authentication failures from legitimate NMS systems |
| Field | Description |
|---|---|
| AuthorizedCredentialAdmins | Accounts authorized to change credentials for ICS service and operator accounts. |
| CredentialChangeImpactWindow | Time window after a credential change within which a service authentication failure is considered directly connected. |
| CredentialRotationSchedule | Documented schedule for routine credential rotation. |
Real-time monitoring identifies a password change event for an Industrial Control System (ICS) service or operator account performed by an account not in the authorized credential administration role, immediately followed by failed authentication attempts from the Industrial Control System (ICS) service itself. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| User Account Authentication (DC0002) | WinEventLog:Security | Windows Security Event ID 4624/4625: EventCode=4723, 4724 for Industrial Control Systems (ICS) service/operator account by account not in authorized credential admins outside credential rotation schedule |
| Application Log Content (DC0038) | WinEventLog:System | Industrial Control Systems (ICS) service failing to start (authentication failure) within credential change impact window of the password change event |
| Field | Description |
|---|---|
| AuthorizedCredentialAdmins | Accounts authorized to change credentials for ICS service and operator accounts. |
| CredentialChangeImpactWindow | Time window after a credential change within which a service authentication failure is considered directly connected. |
| CredentialRotationSchedule | Documented schedule for routine credential rotation. |