Detection of Spearphishing Attachment

Real-time monitoring identifies an Industrial Control System (ICS) field device or embedded engineering terminal receiving malformed or exploit-payload data via its built-in communication interface from an external source, designed to exploit a vulnerability in the device's communication stack. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.

Real-time monitoring identifies an email client or Office application process spawning a script interpreter or shell process on an Industrial Control System (ICS) engineering or operator workstation, immediately following the opening of an email attachment. Documented across multiple ICS incident reports as a primary initial access vector. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.