Real-time monitoring identifies authentication to an external remote access gateway using credentials associated with Industrial Control System (ICS)-role accounts, from a source geolocation or Autonomous System Number (ASN) inconsistent with the account's established usage pattern, immediately followed by that session establishing connectivity into the ICS network zone. Documented in VPNFilter, which specifically targeted routers and network edge devices. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address into device subnet within remote access to Industrial Control Systems (ICS) window of the anomalous authentication |
| Application Log Content (DC0038) | vpn:applog | session duration or command activity inconsistent with documented vendor support session profiles |
| Logon Session Metadata (DC0088) | vpn:authlog | Industrial Control Systems (ICS)-role account authentication from source geolocation/Autonomous System Number (ASN) not in approved remote access origins or outside expected session pattern |
| Field | Description |
|---|---|
| ApprovedRemoteAccessOrigins | Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected. |
| ExpectedSessionPattern | Baseline of normal session timing/duration for each ICS-role account's remote access usage. |
| RemoteAccessToICSWindow | Time window correlating VPN authentication with subsequent ICS-zone network access. |
Near-real-time connection monitoring identifies connections to Industrial Control System (ICS) field device management ports from Internet Protocol (IP) addresses routed through external remote access infrastructure rather than from within the expected ICS network segments. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows. This analytic is implementable from session/flow metadata (endpoints, ports, protocol/service, timing, bytes); it does not require or claim packet-payload visibility.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | NSM:Connections | Connection/session metadata: management-port session to field device originates through external remote-access infrastructure rather than approved internal management path |
| Field | Description |
|---|---|
| ApprovedRemoteAccessOrigins | Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected. |
| ExpectedSessionPattern | Baseline of normal session timing/duration for each ICS-role account's remote access usage. |
| RemoteAccessToICSWindow | Time window correlating VPN authentication with subsequent ICS-zone network access. |
Real-time monitoring identifies an SSH authentication/session to an ICS Linux asset from a VPN-assigned or remote-access source outside the approved remote-administration baseline. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Metadata (DC0088) | syslog:auth | Secure Shell (SSH) session from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly |
| Field | Description |
|---|---|
| ApprovedRemoteAccessOrigins | Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected. |
| ExpectedSessionPattern | Baseline of normal session timing/duration for each ICS-role account's remote access usage. |
| RemoteAccessToICSWindow | Time window correlating VPN authentication with subsequent ICS-zone network access. |
Real-time monitoring identifies an Industrial Control System (ICS)-role account session originating from a Virtual Private Network (VPN)/remote access connection that subsequently accesses Windows ICS hosts in a pattern inconsistent with documented vendor support session profiles. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | WinEventLog:Security | Windows Security Event ID 4624/4625: EventCode=4624 for Industrial Control Systems (ICS)-role account from Virtual Private Network (VPN)-assigned Internet Protocol (IP) address correlated with remote access authentication anomaly |
| Field | Description |
|---|---|
| ApprovedRemoteAccessOrigins | Documented geographic regions/ASNs from which legitimate ICS-role remote access is expected. |
| ExpectedSessionPattern | Baseline of normal session timing/duration for each ICS-role account's remote access usage. |
| RemoteAccessToICSWindow | Time window correlating VPN authentication with subsequent ICS-zone network access. |