Real-time monitoring identifies field device access using credentials matching hardcoded values extracted from Industrial Control System (ICS) vendor firmware or configuration files, from a source with no legitimate operational role. Documented in TriStation 1131 v4.9.0 and earlier, which contained undocumented power-user accounts with hardcoded credentials. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | device authentication success using credential pattern matching known hardcoded credential patterns from source not in approved access list |
| Field | Description |
|---|---|
| KnownHardcodedCredentialPatterns | Documented hardcoded credential values for in-use ICS products, where publicly disclosed by vendors or security researchers. |