Real-time monitoring identifies a Windows process generating Industrial Control System (ICS) command messages to field device tags representing physical outputs, from a process that is not the recognized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) control application, targeting safety-critical output tags. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | opc:applog | command call to field device output tag from process not matching recognized Supervisory Control and Data Acquisition (SCADA)/Distributed Control System (DCS) control application |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate control sources. |
| RapidToggleWindow | Time window within which multiple safety-critical output changes are considered a coordinated event. |
| SafetyCriticalOutputAddresses | Documented register/IOA addresses corresponding to safety-critical outputs per device. |
Real-time monitoring identifies a Linux process making Open Platform Communications (OPC) Unified Architecture (UA) write calls or direct Industrial Control System (ICS) protocol command connections to field device output addresses, from a User Identifier (UID) not associated with the authorized control application. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | decoded ICS protocol write/setpoint operation to a control/output address from a client identity or source not in the approved control-application baseline |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate control sources. |
| RapidToggleWindow | Time window within which multiple safety-critical output changes are considered a coordinated event. |
| SafetyCriticalOutputAddresses | Documented register/IOA addresses corresponding to safety-critical outputs per device. |
Real-time monitoring identifies a control/command message arriving at a field device from a source not in the approved control server list, where the command targets safety-critical output points and does not correspond to any scheduled or operator-acknowledged process action. Documented precedent: Industroyer2 connected directly to specific International Electrotechnical Commission (IEC)-104 RTUs and toggled hardcoded Information Object Addresses (IOAs) to OFF using command type 46, targeting circuit breaker outputs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process/Event Alarm (DC0109) | operationaldb:AlarmEvent | process state change recorded without preceding operator_ack or scheduled switching order reference |
| Process History/Live Data (DC0107) | operationaldb:ProcessHistory | multiple safety-critical outputs toggle within rapid toggle window, pattern consistent with scripted issuance |
| Network Traffic Content (DC0085) | NSM:Content | write/operate command targeting safety-critical output addresses from source not in approved Supervisory Control and Data Acquisition (SCADA) servers |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate control sources. |
| RapidToggleWindow | Time window within which multiple safety-critical output changes are considered a coordinated event. |
| SafetyCriticalOutputAddresses | Documented register/IOA addresses corresponding to safety-critical outputs per device. |