Virtual image

Rogue Cell Towers are false base stations that hijack nearby mobile device connections, performing active or passive attacks against devices. They trick the mobile device into thinking it is connected to an authorized cell tower, leaving it vulnerable to man-in-the-middle attacks and increasing threats to privacy. In this way, an attacker can collect private information about you indirectly through metadata, as well as tracing users' location and capturing the content of messages or calls.

To date, the detection of Rogue Cell Towers can't be done by the mobile device's operating system. Usually, the attacker is not very far from the targeted devices: if possible, start an investigation to find suspicious antennas. Also, if supported, it is advisable to use your mobile device's full 5G connection, less vulnerable than 3G (UMTS) and 4G (LTE) connections.

A parameter describing a configuration version that was previously imported from a project has been observed having a different value in the traffic.

Validate the event and learn it if legitimate, or treat it as anomaly.

A previously unknown protocol Function Code for has appeared in the network.

Validate the event and learn it if legitimate, or treat it as anomaly.

A previously unknown MAC vendor has appeared in the network.

Validate the event and learn it if legitimate, or treat it as anomaly.

A node has started sending variables. It can be a new command, a new object, or a tentative of enumerating existing variables from a malicious attacker.

Validate the event and learn it if legitimate, or treat it as anomaly.

The node has communicated using a function code that is not known for this kind of Asset. This detection is possible by knowing the specific Asset's profile.

Validate the event and learn it if legitimate, or treat it as anomaly.

The node has communicated using a protocol that is not known for this kind of Asset. This detection is possible by knowing the specific Asset's profile.

Validate the event and learn it if legitimate, or treat it as anomaly.

A new MAC Address has started requesting ARP information.

Validate the event and learn it if legitimate, or treat it as anomaly.

A known protocol between two nodes has started using a new function code (i.e. message type). For example, if a client A normally uses a function code 'read' when talking to server B, this alert is raised if client A begins to use a function code 'write'.

Validate the event and learn it if legitimate, or treat it as anomaly.

Two nodes have started communicating with each other with a new protocol.

Validate the event and learn it if legitimate, or treat it as anomaly.

Two nodes have started communicating with each other with a new, confirmed protocol.

Validate the event and learn it if legitimate, or treat it as anomaly.

Two nodes have started communicating with each other.

Validate the event and learn it if legitimate, or treat it as anomaly.

A new MAC Address has appeared in the network.

Validate the event and learn it if legitimate, or treat it as anomaly.

A new network device (switch or router) has appeared on the network.

Validate the event and learn it if legitimate, or treat it as anomaly.

A new node has appeared on the network.

Validate the event and learn it if legitimate, or treat it as anomaly.

A node with a suspicious IP has been detected. It is suggested to validate the health status of communicating nodes, as they may be infected by some malware.

Validate the event and learn it if legitimate, or treat it as anomaly.

A node with a bad reputation IP has been detected. It is suggested to validate the health status of communicating nodes, as they may be infected by some malware.

Validate the event and learn it if legitimate, or treat it as anomaly.

A potentially unwanted application has contacted one of its IP address. This is normally less dangerous than a malware but may have some undesired privacy effects.

Verify that the applications installed on the involved asset are correct.

A new target node has appeared on the network. This node is not yet confirmed to exist as it still has not sent back any data.

Validate the event and learn it if legitimate, or treat it as anomaly.

A variable has been set to a value never seen before.

Validate the event and learn it if legitimate, or treat it as anomaly.

A new variable has been sent, or accessed by a client. It can be a new command, a new object, or a tentative of enumerating existing variables from a malicious attacker.

Validate the event and learn it if legitimate, or treat it as anomaly.

A message aimed at reading/writing one or multiple variables which is sent cyclically, has changed its transmission interval time. Example: a iec104 command breaking its normal transmission cycle.

Validate the event and learn it if legitimate, or treat it as anomaly.

A variable which is sent cyclically has changed its transmission interval time.

Validate the event and learn it if legitimate, or treat it as anomaly.

A new Access Point has been detected with a known SSID. However, the vendor of the newly discovered Access Point differs from the existing ones.

Check if the discovered Access Point is a legit network equipment.