Real-time monitoring identifies remote Windows system-information queries using WMI/CIM, WinRM, PowerShell remoting, or equivalent management tooling where the command names a non-local target and the account/source is outside the approved management baseline. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 remote-management command (for example wmic /node, winrs, or PowerShell/CIM with -ComputerName) includes a remote target and queries system identity/inventory outside the authorized management baseline |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate sources for device identification queries. |
| ApprovedSystemAdmins | Accounts with documented system administration responsibilities. |
| EnumerationTimeWindow | Time window within which multiple enumeration commands are considered a systematic reconnaissance sequence. |
Real-time monitoring identifies an account on an ICS Linux host invoking SSH, SNMP, or another remote-management utility with a non-local target to query remote system identity, hardware, operating-system, or inventory information outside the approved management baseline. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; SSH/SNMP/remote-management command includes a remote target host and queries system identity/inventory from an account outside the authorized management set |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate sources for device identification queries. |
| ApprovedSystemAdmins | Accounts with documented system administration responsibilities. |
| EnumerationTimeWindow | Time window within which multiple enumeration commands are considered a systematic reconnaissance sequence. |
Real-time monitoring identifies Simple Network Management Protocol (SNMP) GET requests targeting system information Object Identifiers (OIDs) from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet, directed at Industrial Control System (ICS) server or device IPs. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | networkdevice:snmp | Simple Network Management Protocol (SNMP) GET to system info OID from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate sources for device identification queries. |
| ApprovedSystemAdmins | Accounts with documented system administration responsibilities. |
| EnumerationTimeWindow | Time window within which multiple enumeration commands are considered a systematic reconnaissance sequence. |
Real-time monitoring identifies Industrial Control System (ICS) protocol requests targeting device identification and system metadata objects from a source not in the approved control server list, specifically aimed at device metadata rather than process values. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | SZL module inventory, Identity Object, or Device Attributes query from source not in approved Supervisory Control and Data Acquisition (SCADA) servers |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate sources for device identification queries. |
| ApprovedSystemAdmins | Accounts with documented system administration responsibilities. |
| EnumerationTimeWindow | Time window within which multiple enumeration commands are considered a systematic reconnaissance sequence. |