Real-time monitoring identifies a process loading a packet capture driver or executing a known capture utility on an Industrial Control System (ICS) host's network interface, from a process or account not associated with documented network analysis responsibilities. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Driver Load (DC0079) | WinEventLog:Sysmon | EventCode= 6 Npcap/WinPcap driver loaded by image not in authorized capture software |
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 capture utility execution from account not in approved network analysts |
| Field | Description |
|---|---|
| ApprovedNetworkAnalysts | Accounts with documented network analysis/diagnostic responsibilities. |
| AuthorizedCaptureSoftware | Allowlist of approved packet capture tools and processes that legitimately load capture drivers. |
Real-time monitoring identifies a process opening a raw socket or executing tcpdump/tshark on an Industrial Control System (ICS) Linux asset's network interface, from a User Identifier (UID) that does not normally perform packet capture. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): raw socket creation (SOCK_RAW) or tcpdump/tshark execution by uid not in authorized capture User Identifiers (UIDs) |
| Field | Description |
|---|---|
| ApprovedNetworkAnalysts | Accounts with documented network analysis/diagnostic responsibilities. |
| AuthorizedCaptureSoftware | Allowlist of approved packet capture tools and processes that legitimately load capture drivers. |
Real-time monitoring identifies a new device on the Industrial Control System (ICS) network placing its Network Interface Card (NIC) in promiscuous mode, detectable by anomalous broadcast traffic handling or unauthorized Switched Port Analyzer (SPAN) session requests on managed switches. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | unauthorized Switched Port Analyzer (SPAN) session request or port mirroring configuration from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| ApprovedNetworkAnalysts | Accounts with documented network analysis/diagnostic responsibilities. |
| AuthorizedCaptureSoftware | Allowlist of approved packet capture tools and processes that legitimately load capture drivers. |
Real-time monitoring identifies unauthorized Switch Port Analyzer (SPAN) session configuration or port mirroring enabled from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) on an Industrial Control System (ICS) switch. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | Switched Port Analayzer (SPAN) session or port mirroring configuration change from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| ApprovedNetworkAnalysts | Accounts with documented network analysis/diagnostic responsibilities. |
| AuthorizedCaptureSoftware | Allowlist of approved packet capture tools and processes that legitimately load capture drivers. |