Operations
Threat hunting in OT
Hunting in a plant starts with knowing normal. Each playbook states a hypothesis, the data it needs, the steps to run and what to do when something looks wrong.
Know normal, find abnormal
- Baseline peers, protocols, function codes and timing per zone before you hunt
- Prefer passive network data and existing engineering telemetry over active collection
- Every finding is validated with operations before any action touches the process
- Write down what you learned about normal — the baseline is the durable output
Core data sources
- Passive network capture / OT IDS
- Firewall and boundary logs
- Engineering workstation logs
- Controller event and mode logs
- Historian and alarm data
- Remote access session logs
Why should I care?
OT hunting rarely finds malware. It finds a new peer talking a programming protocol, a mode change nobody scheduled, or a session at 03:00 from a vendor account — all of which are visible only if you know the baseline.
Intermediate
Unauthorized PLC Programming
Identify programming or configuration operations against controllers that were not performed by an authorised engineer in an approved change window.
Advanced
Unexpected Controller Logic Changes
Detect differences between the running controller logic and the approved engineering baseline.
Foundational
New Engineering Workstation Appears
Find hosts newly behaving like engineering workstations — running engineering software or speaking programming protocols.
Foundational
Suspicious Remote Access into OT
Identify remote sessions into the OT environment that lack a named user, approval, or business justification.
Intermediate
Unexpected IT-to-OT Communication
Find traffic crossing the IT/OT boundary that is not part of the approved communication matrix.
Advanced
Rogue Master or Controlling Station
Detect an additional master, controlling station or publisher issuing commands on an industrial protocol.
Intermediate
Industrial Protocol Write Activity
Surface write operations on industrial protocols and confirm each has an operational reason.
Foundational
New Device in a Control Zone
Identify devices that appeared in a control zone without a corresponding project or work order.
Intermediate
Scanning or Enumeration on OT Networks
Detect discovery behaviour inside OT networks, including protocol-specific enumeration.
Intermediate
Abnormal HMI Communication
Detect HMIs communicating with unusual peers, services or destinations.
Advanced
Engineering Workstation Compromise
Hunt for signs that an engineering host has been compromised before it is used to change a controller.
Advanced
Unauthorized Firmware Change
Identify devices whose firmware version or integrity state changed without an approved work order.
Foundational
Unexpected Controller Mode Change
Find controllers transitioning between Run, Program, Stop or remote/local states without an approved reason.
Foundational
Unapproved USB / Removable Media
Identify removable media use on OT hosts, especially engineering and operator systems.
Intermediate
Historian Data Exfiltration
Detect abnormal bulk extraction of process data from historians or reporting systems.
Intermediate
Unauthorized Wireless Connectivity
Find wireless access points, cellular modems or ad-hoc links in or attached to OT networks.
Intermediate
Abnormal Authentication in OT
Identify authentication patterns in the OT environment that do not match normal operational behaviour.
Expert
Safety System Communication Anomalies
Detect any unexpected communication, configuration change or state change involving safety systems.
Foundational
Unexpected Internet Connectivity from OT
Find OT assets communicating with internet destinations, inbound or outbound.
Intermediate
Vendor Account Misuse
Verify that third-party accounts are used only within approved scope, time and destination.
Advanced
Time Synchronisation Manipulation
Detect changes to time sources or unexplained clock offsets across OT systems.
Foundational
Default Credentials and Internet-Exposed Field Devices
Find control devices that are reachable from the internet or still using factory-default credentials, before an opportunistic actor does.