Built-in checks

A cleartext password has been issued or requested.

Consider to update to secure communication or evaluate the risks of having this data exposed on the network.

A changed configuration has been uploaded to the OT device. This can be a legitimate operation during maintenance and upgrade of the software or an unauthorized tentative to disrupt the normal behavior of the system.

Verify the device configuration and status.

An installed software change has been detected. The change relates to the vulnerabilities list, possibly changing it.

Verify the device configuration and status, and the reason behind the software change.

A command that can alter the device state has been detected. Examples are a request of reset of processor's memory, and technology-specific cases.

Verify the device configuration and status, and the reason behind the command.

Suspicious transfer of Dual Use Application (DUALUSE) named.

Verify the usage of the application and, if malicious, cleanup the victim, and block or cleanup also the attacker.

A DNS query towards a suspicious domain has been detected.

Investigate on the health status of the involved nodes.

A node with a suspicious IP has been detected.

Validate the health status of the communicating nodes, as they may be infected by some malware.

A request towards a suspicious URL has been detected.

Investigate on the health status of the involved nodes.

A firmware has been transferred to the device. This can be a legitimate operation during maintenance or an unauthorized attempt to change the behaviour of the device.

Verify the device configuration and status, and the possible presence of malicious actors.

Sensitive information has been transferred between an OT Device (e.g. an IED) and a workstation / local SCADA. This can be a legitimate troubleshooting operation or an unauthorized attempt to extract some device information.

Investigate on the actor that has initiated the transfer and on the transferred information.

A DNS query towards a malicious domain has been detected.

Investigate on why this domain has been contacted and consider to ban it from your network.

Suspicious behaviour detected in a device announcing itself as Human Interface Device (HID). It may be compromised, including malicious software running on it and performing dangerous actions targeting the main system it is connected to.

Disconnect the Human Interface Device (HID) and inspect it carefully, it might have an miniature embedded chip inside. Find the root cause of the unexpected behavior.

A node with a bad reputation IP has been found.

Investigate on why this IP has been contacted and consider to ban it from your network.

A request towards a malicious URL has been detected.

Investigate on why this URL has been contacted and consider to ban it from your network.

A potentially malicious payload has been transferred.

Investigate on the malware source and infected device, and consider to remove the file.

A potential MITM attack has been detected. The attacker is ARP-poisoning the victims. The attacker node could alter the communication between its victims.

Investigate on the network configuration and the possible presence of malicious actors.

An OT device program has been requested to reboot (e.g. by the engineering workstation). This may be something due to Engineering operations, for instance the maintenance of the program itself or a system updates. However, it may indicate suspicious activity from an attacker trying to manipulate the device execution.

Investigate on the network configuration and the possible presence of malicious actors.

An OT device program has been requested to start (e.g. by the engineering workstation). This may be something due to Engineering operations, for instance the maintenance of the program itself or a system updates. However, it may indicate suspicious activity from an attacker trying to manipulate the device execution.

Investigate on the network configuration and the possible presence of malicious actors.

An OT device program has been requested to stop (e.g. by the engineering workstation). This may be something due to Engineering operations, for instance the maintenance of the program itself or a system updates. However, it may indicate suspicious activity from an attacker trying to manipulate the device execution.

Investigate on the network configuration and the possible presence of malicious actors.

A host has shown a sudden increase of outbound connections. This could be due to the presence of a malware.

Investigate on the reason behind such connections to the outside on the device, and consider to update the network configuration to prevent them.

A packet has matched a Packet rule.

Verify the device configuration and status, and the possible presence of malicious actors.

A weak password, possibly default, has been used to access a resource.

Consider to update your passwords.

A changed program has been uploaded to the OT device. This can be a legitimate operation during maintenance and upgrade of the software or an unauthorized tentative to disrupt the normal behavior of the system.

Verify the device configuration and status, and the possible presence of malicious actors.

A program has been transferred between an OT Device (e.g. an IED) and a workstation / local SCADA. This can be a legitimate operation during maintenance and upgrade of the software or an unauthorized attempt to read the program logic.

Investigate on the entity that has initiated the transfer and on the program content.

A potentially unwanted application payload (PUA) has been transferred. This is normally less dangerous than a malware payload.

Investigate on the malware source and infected device, and consider to remove the payload.

A DNS query towards a suspicious domain has been detected.

Investigate on the health status of the involved nodes.

A node with a suspicious IP has been detected.

Validate the health status of the communicating nodes, as they may be infected by some malware.

A request towards a suspicious URL has been detected.

Investigate on the health status of the involved nodes.

Rule-dependent. A suspicious local event has been detected on a machine.

Rule-dependent. Verify the device configuration and status, and the possible presence of malicious processes.

A suspicious time has been observed in the network. There could be a malfunctioning device or a packet injection.

Verify the device configuration and status.

This is most likely a human driven event.

USB devices might be a physical infiltration vector carrying files with malicious behaviour. Check the device nature and its content.

A user or operator has connected a USB device and transferred data, or a script might have initiated the operation.

Verify whether the operation is permitted.

The communication has been encrypted using an obsolete cryptographic protocol, weak cipher suites or invalid certificates.

Consider to update to more secure algorithms or evaluate the risks of having this technology still used on the netowrk.

The 802.11 family of standards (also known as WiFi) includes a way for Access Points to disconnect clients through specific packets. However, this management functionality allows attackers to disrupt WiFi networks easily.

More recent 802.11 Access Points and devices support the 802.11w extension, which makes client deauthentication and disassociation available only from real Access Points governing those clients. Check with your Access Point configuration if such extension is available, and enable it.

An attacker may be aware that a wireless-enabled device is flawed by an XSS vulnerability in its web interface, and they are trying to leverage this issue to get execution of arbitrary HTML/JavaScript code. If successful, in the worst case, this can lead to full device compromise and network penetration.

Typically, exploiting these vulnerabilities requires user interaction. For example, the vulnerable web application must be accessed through a web browser. Advise your personnel to avoid browsing web applications related to wireless devices until the rogue SSID has been taken down.

A wireless packet that looks to have been injected by an attacker has been captured.

Check the surroundings of the involved assets and its wireless network.

A wireless suspicious packet has been captured. Something does not look as it should according to the protocol or specifications.

Check the involved assets and wireless network.

A wireless packet that is not complying to protocol rules has been captured on the network.

Check that the involved assets have not been compromised.