Real-time monitoring identifies malformed or out-of-spec ICS protocol exchanges targeting an embedded device from a source outside the approved communication baseline. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | anomalous protocol exchange preceding device behavioral change (reboot, altered configuration) |
| Field | Description |
|---|---|
| ExploitCrashCorrelationWindow | Time window correlating a memory access event with a subsequent crash. |
| TrustedSecurityToolList | Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access. |
Real-time monitoring identifies ptrace syscalls or /proc/pid/mem write operations targeting Industrial Control System (ICS) service processes from a process that is not a debugger or vendor diagnostic tool. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Process Access (DC0035) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=ptrace/process_vm_readv; process accesses an ICS service process PID from an image or UID not in the debugger/diagnostic allowlist |
| Field | Description |
|---|---|
| ExploitCrashCorrelationWindow | Time window correlating a memory access event with a subsequent crash. |
| TrustedSecurityToolList | Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access. |
Real-time monitoring identifies Industrial Control System (ICS) network device syslog recording unexpected restarts or crashes coinciding with anomalous traffic patterns on management interfaces. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | unexpected restart or crash coinciding with anomalous traffic pattern on management interface |
| Field | Description |
|---|---|
| ExploitCrashCorrelationWindow | Time window correlating a memory access event with a subsequent crash. |
| TrustedSecurityToolList | Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access. |
Real-time monitoring identifies an Industrial Control System (ICS) vendor process crashing unexpectedly, immediately preceded by an unusual cross-process memory access event from a process outside the recognized security/diagnostic tool allowlist. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Process Access (DC0035) | WinEventLog:Sysmon | EventCode=10 cross-process memory access into Industrial Control Systems (ICS) vendor process from image not in trusted security tool list, followed by unexpected termination within exploit crash correlation window |
| Field | Description |
|---|---|
| ExploitCrashCorrelationWindow | Time window correlating a memory access event with a subsequent crash. |
| TrustedSecurityToolList | Allowlist of legitimate security/diagnostic tools authorized to perform cross-process memory access. |