Real-time monitoring identifies an Industrial Control System (ICS) protocol restart/reset command directed at a field device from a source not in the approved engineering workstation list, particularly where multiple devices receive restart commands within a short window. Documented precedent: Industroyer exploited CVE-2015-5374 via a crafted 18-byte User Datagram Protocol (UDP) packet to port 50000 on Siemens SIPROTEC relays. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Device Alarm (DC0108) | operationaldb:AlarmEvent | more than one device generates restart/offline alarm within bulk restart time window without open maintenance ticket |
| Network Traffic Content (DC0085) | NSM:Content | restart/reset service from source not in engineering workstation list outside change control window |
| Network Traffic Flow (DC0078) | NSM:Content | non-standard or malformed packet to device-specific diagnostic port immediately preceding a device-offline alarm |
| Field | Description |
|---|---|
| BulkRestartTimeWindow | Time window within which multiple device restarts are considered a coordinated event. |
| ChangeControlWindow | Scheduled maintenance periods during which restarts are authorized. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue device restart commands. |
Real-time monitoring identifies an Industrial Control System (ICS) Linux engineering tool issuing device restart commands outside a scheduled maintenance window, from a User Identifier (UID) not in the approved engineer list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; device restart/shutdown command invoked outside the approved change-control window by an unauthorized UID |
| Field | Description |
|---|---|
| BulkRestartTimeWindow | Time window within which multiple device restarts are considered a coordinated event. |
| ChangeControlWindow | Scheduled maintenance periods during which restarts are authorized. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue device restart commands. |
Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to power Management Information Base (MIB) restart Object Identifiers (OIDs) or Command Line Interface (CLI) reload commands from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:snmp | Simple Network Management Protocol (SNMP) SET to power Management Information Base (MIB) restart Object Identifier (OID) or Command Line Interface (CLI) reload command from source not in approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| BulkRestartTimeWindow | Time window within which multiple device restarts are considered a coordinated event. |
| ChangeControlWindow | Scheduled maintenance periods during which restarts are authorized. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue device restart commands. |
Real-time monitoring identifies Industrial Control System (ICS) vendor engineering software initiating a device restart command from a Windows host outside a scheduled maintenance window. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | engineeringworkstation:ApplicationLog | device restart command initiated outside change control window by account not in approved engineer list |
| Field | Description |
|---|---|
| BulkRestartTimeWindow | Time window within which multiple device restarts are considered a coordinated event. |
| ChangeControlWindow | Scheduled maintenance periods during which restarts are authorized. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to issue device restart commands. |