Real-time monitoring identifies wireless controller management log entries showing Service Set Identifier (SSID) or Media Access Control (MAC) address filter configuration changes for the Industrial Control System (ICS) wireless network from an account not in the authorized wireless admins. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | WinEventLog:Application | wireless controller management log: SSID or MAC filter config change from account not in authorized wireless admins |
| Field | Description |
|---|---|
| ApprovedWirelessAdminList | Accounts/sources authorized to modify wireless infrastructure configuration. |
| DeauthTimeWindow | Time window within which multiple deauthentication events are considered a coordinated mass event. |
| MassDeauthThreshold | Number of simultaneously deauthenticated enrolled devices that constitutes a mass event. |
Real-time monitoring identifies hostapd or wireless controller configuration changes on Linux-based access points disabling the Industrial Control System (ICS) wireless Service Set Identifier (SSID), by a User Identifier (UID) not in the authorized wireless admin UIDs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; hostapd/wireless-controller configuration command disables or alters an ICS wireless network outside the authorized wireless-administration baseline |
| Field | Description |
|---|---|
| ApprovedWirelessAdminList | Accounts/sources authorized to modify wireless infrastructure configuration. |
| DeauthTimeWindow | Time window within which multiple deauthentication events are considered a coordinated mass event. |
| MassDeauthThreshold | Number of simultaneously deauthenticated enrolled devices that constitutes a mass event. |
Real-time monitoring identifies a mass deauthentication event targeting multiple enrolled Industrial Control System (ICS) wireless devices simultaneously, or a wireless access point configuration change excluding enrolled device Media Access Control (MAC) address from the association list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | networkdevice:syslog | deauthentication targeting more than mass deauth threshold enrolled devices within deauth time window, or Media Access Control (MAC) address filter config change excluding enrolled devices, from source not in approved wireless admin list |
| Field | Description |
|---|---|
| ApprovedWirelessAdminList | Accounts/sources authorized to modify wireless infrastructure configuration. |
| DeauthTimeWindow | Time window within which multiple deauthentication events are considered a coordinated mass event. |
| MassDeauthThreshold | Number of simultaneously deauthenticated enrolled devices that constitutes a mass event. |
Real-time monitoring identifies deauthentication frames targeting enrolled Industrial Control System (ICS) wireless device Media Access Control (MAC) address from a source not in the approved wireless infrastructure. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Flow (DC0078) | NSM:Content | deauthentication flood targeting enrolled Industrial Control Systems (ICS) wireless device Media Access Control (MAC) addresses from source not in approved wireless infrastructure |
| Field | Description |
|---|---|
| ApprovedWirelessAdminList | Accounts/sources authorized to modify wireless infrastructure configuration. |
| DeauthTimeWindow | Time window within which multiple deauthentication events are considered a coordinated mass event. |
| MassDeauthThreshold | Number of simultaneously deauthenticated enrolled devices that constitutes a mass event. |