Real-time monitoring identifies an Industrial Control System (ICS) protocol message sequence placing a field device into firmware-update mode from a source not in the approved engineering workstation list, correlated with the device's alarm telemetry going silent within a short grace period without acknowledgment. Documented precedent: Industroyer exploited CVE-2015-5374 by sending a crafted packet that initiated an incomplete firmware update sequence on Siemens Protection Technology (SIPROTEC) relays. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Device Alarm (DC0108) | operationaldb:AlarmEvent | device_ip alarm telemetry goes silent within alarm silence grace period of the mode-activation message without operator acknowledgment |
| Network Traffic Content (DC0085) | NSM:Content | firmware-update-mode activation service from source not in engineering workstation list outside change control window |
| Application Log Content (DC0038) | engineeringworkstation:ApplicationLog | firmware update mode entry logged without corresponding change ticket reference |
| Field | Description |
|---|---|
| AlarmSilenceGracePeriod | Time window within which alarm telemetry going silent following a mode-change message is considered directly connected. |
| AuthorizedFirmwareManagers | Accounts authorized to perform firmware update mode activation. |
| ChangeControlWindow | Scheduled maintenance periods during which firmware update mode activation is authorized. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to activate firmware update mode. |
| MaintenanceWindowSchedule | Recurring scheduled periods when firmware update activities are expected. |
Real-time monitoring identifies a firmware update tool on an Industrial Control System (ICS) Linux engineering host initiating firmware-update mode activation outside a scheduled maintenance window, by a User Identifier (UID) not in the approved firmware manager UIDs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; firmware-update utility invoked outside the approved maintenance window or by a UID not in the authorized firmware-management set |
| Field | Description |
|---|---|
| AlarmSilenceGracePeriod | Time window within which alarm telemetry going silent following a mode-change message is considered directly connected. |
| AuthorizedFirmwareManagers | Accounts authorized to perform firmware update mode activation. |
| ChangeControlWindow | Scheduled maintenance periods during which firmware update mode activation is authorized. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to activate firmware update mode. |
| MaintenanceWindowSchedule | Recurring scheduled periods when firmware update activities are expected. |
Real-time monitoring identifies transfer protocol traffic such as the Trivial File Transfer Protocol (TFTP) or vendor-specific protocol traffic initiating firmware-update mode on Industrial Control System (ICS) device Internet Protocol (IP) addresses from sources not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): firmware-mode activation protocol session from source not in engineering workstation list |
| Field | Description |
|---|---|
| AlarmSilenceGracePeriod | Time window within which alarm telemetry going silent following a mode-change message is considered directly connected. |
| AuthorizedFirmwareManagers | Accounts authorized to perform firmware update mode activation. |
| ChangeControlWindow | Scheduled maintenance periods during which firmware update mode activation is authorized. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to activate firmware update mode. |
| MaintenanceWindowSchedule | Recurring scheduled periods when firmware update activities are expected. |
Real-time monitoring identifies a vendor firmware update tool activating firmware-update mode on a field device from a Windows host, outside a scheduled maintenance window or by an account not in the approved firmware management role. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 firmware update tool process activating firmware mode, by account not in authorized firmware managers, outside maintenance window schedule |
| Field | Description |
|---|---|
| AlarmSilenceGracePeriod | Time window within which alarm telemetry going silent following a mode-change message is considered directly connected. |
| AuthorizedFirmwareManagers | Accounts authorized to perform firmware update mode activation. |
| ChangeControlWindow | Scheduled maintenance periods during which firmware update mode activation is authorized. |
| EngineeringWorkstationList | IP allowlist of workstations authorized to activate firmware update mode. |
| MaintenanceWindowSchedule | Recurring scheduled periods when firmware update activities are expected. |