Real-time monitoring identifies a user-invoked action on an Industrial Control System (ICS) workstation immediately followed by a process execution chain inconsistent with normal ICS operations -- the user-driven trigger plus the resulting anomalous execution chain together distinguish this from generic malware execution. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 chain originating from user-invoked file open or link click action, spawning processes not in expected document viewer children |
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 from resulting process to destinations not in approved destinations list |
| Field | Description |
|---|---|
| ApprovedDestinations | Allowlist of network destinations consistent with legitimate document/link content. |
| ExpectedDocumentViewerChildren | Documented normal child processes for legitimate document viewers/handlers. |
Real-time monitoring identifies a user-facing application on an ICS Linux workstation spawning a child process outside the expected application-child baseline. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; document/viewer process launches a child process outside the expected viewer-child baseline |
| Field | Description |
|---|---|
| ApprovedDestinations | Allowlist of network destinations consistent with legitimate document/link content. |
| ExpectedDocumentViewerChildren | Documented normal child processes for legitimate document viewers/handlers. |
Real-time monitoring identifies an Industrial Control System (ICS) embedded device executing a sequence of operations inconsistent with its programmed logic, correlating temporally with an operator interaction on an engineering terminal connected to the device. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | otndr:BehaviorAlert | device Input/Output (I/O) state change inconsistent with programmed logic correlating temporally with operator terminal interaction |
| Field | Description |
|---|---|
| ApprovedDestinations | Allowlist of network destinations consistent with legitimate document/link content. |
| ExpectedDocumentViewerChildren | Documented normal child processes for legitimate document viewers/handlers. |
| ID | Asset |
|---|---|
| A0001 | Workstation |
| A0002 | Human-Machine Interface (HMI) |
| A0012 | Jump Host |