Real-time monitoring identifies successful authentication to Windows-hosted Industrial Control System (ICS) applications using credentials matching known default or hardcoded vendor passwords. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | WinEventLog:Security | Windows Security Event ID 4624/4625: EventCode=4624 for account matching default or hardcoded credential patterns from source not in approved host list |
| Field | Description |
|---|---|
| DefaultVendorCredentialList | Documented default username/password combinations for all device models in the environment. |
| EngineeringWorkstationList | IP allowlist of legitimate authentication sources. |
| KnownHardcodedCredentialPatterns | Documented hardcoded credential values for in-use ICS products. |
Real-time monitoring identifies authentication attempts against Industrial Control System (ICS) network device management interfaces using default or hardcoded vendor credentials from sources not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| User Account Authentication (DC0002) | networkdevice:syslog | Device authentication/audit log: successful authentication using a default/hardcoded/prohibited account from a non-approved management source |
| Field | Description |
|---|---|
| DefaultVendorCredentialList | Documented default username/password combinations for all device models in the environment. |
| EngineeringWorkstationList | IP allowlist of legitimate authentication sources. |
| KnownHardcodedCredentialPatterns | Documented hardcoded credential values for in-use ICS products. |
Real-time monitoring identifies successful authentication to an Industrial Control System (ICS) device or application using credentials that are either documented vendor defaults (T1694.001) or extracted from configuration files/firmware where stored in cleartext (T1694.002), from a source not in the approved access list. This technique-level analytic unifies both sub-techniques. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | NSM:Content | authentication success using credential matching default vendor credential list or known hardcoded credential patterns from source not in engineering workstation list |
| Field | Description |
|---|---|
| DefaultVendorCredentialList | Documented default username/password combinations for all device models in the environment. |
| EngineeringWorkstationList | IP allowlist of legitimate authentication sources. |
| KnownHardcodedCredentialPatterns | Documented hardcoded credential values for in-use ICS products. |
Real-time monitoring identifies successful SSH or application authentication using credentials matching known default or hardcoded vendor passwords on Industrial Control System (ICS) Linux assets. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.
| Data Component | Name | Channel |
|---|---|---|
| Logon Session Creation (DC0067) | syslog:auth | sshd Accepted for username matching default or hardcoded credential patterns from source not in approved admin Classless Inter-Domain Routing (CIDR) subnet |
| Field | Description |
|---|---|
| DefaultVendorCredentialList | Documented default username/password combinations for all device models in the environment. |
| EngineeringWorkstationList | IP allowlist of legitimate authentication sources. |
| KnownHardcodedCredentialPatterns | Documented hardcoded credential values for in-use ICS products. |