Real-time monitoring identifies a trusted, signed Windows system binary executing with command-line arguments inconsistent with its documented administrative purpose -- specifically arguments indicating payload decoding, remote content execution, or script invocation -- on an Industrial Control System (ICS) host. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 image matches certutil.exe/regsvr32.exe/mshta.exe/rundll32.exe and command line matches Living-off-the-Land Binary (LOLBin) abuse patterns on host in Industrial Control Systems (ICS) workstation inventory |
| Field | Description |
|---|---|
| ICSWorkstationInventory | Inventory of ICS hosts warranting this elevated monitoring. |
| LOLBinAbusePatterns | Documented command-line argument patterns for living-off-the-land binary abuse. |
Real-time monitoring identifies system binaries (bash, python, perl, awk, dd) on Industrial Control System (ICS) Linux assets executing with arguments that pipe or decode external content rather than performing their documented administrative function. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): system binary executing with command line piping or decoding external content, from Industrial Control Systems (ICS) service account User Identifier (UID) |
| Field | Description |
|---|---|
| ICSWorkstationInventory | Inventory of ICS hosts warranting this elevated monitoring. |
| LOLBinAbusePatterns | Documented command-line argument patterns for living-off-the-land binary abuse. |
Real-time monitoring identifies Industrial Control System (ICS) protocol messages using embedded device built-in utilities or vendor-supplied diagnostic tools to execute payloads, from sources not in the approved engineering workstation list, containing payloads inconsistent with legitimate diagnostic use. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | vendor diagnostic function code with payload matching code execution pattern from source not in engineering workstation list |
| Field | Description |
|---|---|
| ICSWorkstationInventory | Inventory of ICS hosts warranting this elevated monitoring. |
| LOLBinAbusePatterns | Documented command-line argument patterns for living-off-the-land binary abuse. |
| ID | Asset |
|---|---|
| A0001 | Workstation |
| A0002 | Human-Machine Interface (HMI) |
| A0006 | Data Historian |
| A0007 | Control Server |
| A0008 | Application Server |
| A0012 | Jump Host |