Real-time monitoring identifies execution of port scanning utilities (nmap, masscan) with arguments targeting Industrial Control System (ICS) protocol port ranges on an ICS Windows host. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1 of port scanning utility with arguments targeting Industrial Control Systems (ICS) protocol port ranges |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate sources. |
| PortScanTimeWindow | Time window within which connections across multiple ports are considered a single scan event. |
Real-time monitoring identifies execve of port scanning utilities on an Industrial Control System (ICS) Linux asset with arguments targeting ICS protocol port ranges. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): execve of nmap/masscan with arguments targeting Industrial Control Systems (ICS) protocol port ranges |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate sources. |
| PortScanTimeWindow | Time window within which connections across multiple ports are considered a single scan event. |
Real-time monitoring identifies a host generating rapid, sequential Transmission Control Protocol (TCP) connection attempts across multiple destination ports on Industrial Control System (ICS) device Internet Protocol (IP) addresses, targeting ICS-specific protocol ports, from a source not in the approved control server inventory. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | netflow:ipfix | IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): source generates short-lived flows to single dst across multiple Industrial Control Systems (ICS) protocol ports (502,102,44818,20000,4840) within port scan time window, source not in approved Supervisory Control and Data Acquisition (SCADA) servers |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate sources. |
| PortScanTimeWindow | Time window within which connections across multiple ports are considered a single scan event. |
Real-time monitoring identifies rapid sequential Industrial Control System (ICS) protocol connection attempts to the same field device Internet Protocol (IP) address across different protocol ports from a single source not in the approved control server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.
| Data Component | Name | Channel |
|---|---|---|
| Network Connection Creation (DC0082) | NSM:Connections | rapid sequential connection attempts to same device Internet Protocol (IP) address across multiple Industrial Control System (ICS) protocol ports from source not in approved Supervisory Control and Data Acquisition (SCADA) servers |
| Field | Description |
|---|---|
| ApprovedSCADAServers | IP allowlist of legitimate sources. |
| PortScanTimeWindow | Time window within which connections across multiple ports are considered a single scan event. |