Real-time monitoring identifies a loss of communication with serially-connected field devices correlated with a configuration change event on the serial-to-Ethernet gateway. Documented in the 2015 Ukraine attack, where Sandworm used malicious firmware to render serial-to-Ethernet converters inoperable. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process/Event Alarm (DC0109) | operationaldb:AlarmEvent | device_ip communication-loss alarm within serial block correlation window of a flagged serial gateway configuration change |
| Application Log Content (DC0038) | serialgw:syslog | serial port parameter change (baud rate, parity, port disable) without corresponding change ticket reference |
| Field | Description |
|---|---|
| SerialBlockCorrelationWindow | Time window within which a serial gateway configuration change and subsequent device communication loss are considered causally connected. |
Real-time monitoring identifies writes to serial device configuration files or stty commands changing serial port parameters on Industrial Control System (ICS) Linux gateway hosts from a User Identifier (UID) not associated with authorized serial port management. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | auditd:SYSCALL+PATH | Linux Audit SYSCALL+PATH records: PATH record shows modification of a serial-device configuration file by a UID not in the authorized serial-administration set |
| Field | Description |
|---|---|
| SerialBlockCorrelationWindow | Time window within which a serial gateway configuration change and subsequent device communication loss are considered causally connected. |
Real-time monitoring identifies configuration changes to serial server or terminal server devices that alter serial port parameters for ports connected to field devices. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | serial server configuration change altering port parameters for field device ports from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| SerialBlockCorrelationWindow | Time window within which a serial gateway configuration change and subsequent device communication loss are considered causally connected. |
Real-time monitoring identifies Windows serial port configuration changes on Industrial Control System (ICS) gateway hosts that would disrupt communication with serial field devices. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Windows Registry Key Modification (DC0063) | WinEventLog:Sysmon | EventCode=13 to Communication (COM) port configuration key by process not in authorized serial port management tools |
| Field | Description |
|---|---|
| SerialBlockCorrelationWindow | Time window within which a serial gateway configuration change and subsequent device communication loss are considered causally connected. |