Real-time monitoring identifies the absence of expected command-message delivery confirmation -- a Supervisory Control and Data Acquisition (SCADA)-issued command that does not produce the expected corresponding state-change response within the normal response latency window, while the device remains reachable for other traffic. Documented in the 2015 Ukraine attack, where Sandworm used malicious firmware to render serial-to-Ethernet converters inoperable. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process History/Live Data (DC0107) | operationaldb:ProcessHistory | process value expected to change following a command does not change within command confirmation window |
| Network Traffic Flow (DC0078) | NSM:Connections | command-type traffic to device_ip absent while other traffic types (polling, reporting) to the same device continue normally |
| Application Log Content (DC0038) | scada:applog | command issued to device_ip with no corresponding state-change confirmation received within command confirmation window |
| Field | Description |
|---|---|
| CommandConfirmationWindow | Maximum expected latency between a command being issued and its corresponding state-change confirmation. |
Real-time monitoring identifies iptables/nftables rule additions on Industrial Control System (ICS) Linux gateways that filter ICS command messages based on content, while allowing other traffic to pass. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; command line invokes iptables/nftables to change ICS traffic filtering or redirection outside the authorized network-administration baseline |
| Field | Description |
|---|---|
| CommandConfirmationWindow | Maximum expected latency between a command being issued and its corresponding state-change confirmation. |
Real-time monitoring identifies Windows host-based firewall rule modifications or network interface configuration changes on Industrial Control System (ICS) Windows servers that block ICS command-message traffic, coinciding with Supervisory Control and Data Acquisition (SCADA) showing communication loss to field devices. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Security | EventCode=5157 or firewall rule changes blocking Industrial Control Systems (ICS) command message traffic |
| Field | Description |
|---|---|
| CommandConfirmationWindow | Maximum expected latency between a command being issued and its corresponding state-change confirmation. |