Real-time monitoring identifies Industrial Control System (ICS) master-role command traffic originating from a source not in the approved control server inventory, directed at multiple field devices in a pattern consistent with control-server behavior. Documented in Maroochy Water Services (falsified PDS/station addresses to impersonate the master) and the 2017 Dallas Siren incident (rogue radio transmitter to 156 sirens). OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.
| Data Component | Name | Channel |
|---|---|---|
| Asset Inventory (DC0110) | assetinventory:MasterAddress | command traffic uses master/station address not in registered master addresses |
| Device Alarm (DC0108) | operationaldb:AlarmEvent | device receives commands from two distinct master identities within a short window |
| Network Traffic Content (DC0085) | NSM:Content | write/control command traffic from source not in approved Supervisory Control and Data Acquisition (SCADA) servers directed at multiple distinct device IPs within rogue master time window |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP/identity allowlist of legitimate master/control server systems. |
| RegisteredMasterAddresses | Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP. |
| RogueMasterTimeWindow | Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event. |
Real-time monitoring identifies a Linux process opening Industrial Control System (ICS) protocol master connections to multiple field device Internet Protocol (IP) addresses, from a host that is not the authorized Supervisory Control and Data Acquisition (SCADA) server. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): connect syscalls show a host outside the approved SCADA/master set opening ICS-protocol connections to multiple field devices |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP/identity allowlist of legitimate master/control server systems. |
| RegisteredMasterAddresses | Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP. |
| RogueMasterTimeWindow | Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event. |
Real-time monitoring identifies a new device appearing on the Industrial Control System (ICS) network with network behavior consistent with an ICS master station, with a Media Access Control (MAC) address not in the approved device inventory. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): new device Media Access Control (MAC) address on Industrial Control Systems (ICS) network generating ICS master-pattern traffic such as polling multiple device Internet Protocol (IP) addresses on ICS protocol ports |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP/identity allowlist of legitimate master/control server systems. |
| RegisteredMasterAddresses | Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP. |
| RogueMasterTimeWindow | Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event. |
Real-time monitoring identifies Industrial Control System (ICS) protocol master-role traffic originating from a Windows host that is not the authorized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) server. OT operational-fidelity gate: Alert only when the master/station identity or source is not authorized for the target device and command function, or when a normally authorized master violates its configured role/sequence and produces a corroborating device/process-state change. Suppress legitimate redundancy/failover, hot-standby promotion, commissioning, and approved engineering master activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | WinEventLog:Sysmon | EventCode=3 unexpected Windows host opening Industrial Control Systems (ICS) protocol connections to multiple field device Internet Protocol (IP) addresses in polling pattern characteristic of master station |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP/identity allowlist of legitimate master/control server systems. |
| RegisteredMasterAddresses | Inventory of authorized station/master addresses for protocols using logical addressing distinct from IP. |
| RogueMasterTimeWindow | Time window within which command traffic to multiple devices from a single unrecognized source is considered a coordinated rogue master event. |