Skip to main content
OT Atlas
Search

Hunt playbook

Engineering Workstation Compromise

Hunt for signs that an engineering host has been compromised before it is used to change a controller.

AdvancedT0862T0864T0843

Hypothesis

An engineering host may be executing unauthorised code or being accessed by an unexpected identity.

Why this hunt matters

The engineering workstation is the most efficient path from an IT-style intrusion to physical consequence.

Scope

Assets: engineering-workstation, plc, safety-plc

Protocols: s7comm, ethernet-ip, ads-ams

Data sources required

  • Endpoint process and script execution logs
  • Authentication logs
  • Removable media events
  • Network metadata
  • Software inventory

Baseline needed first

  • A short, well-known application set; predictable network peers; named engineer logons

Hunt steps

  1. 01Review process creation for scripting engines, remote access tools and unsigned binaries
  2. 02Review logons: accounts, times, and remote versus console sessions
  3. 03Check removable media insertion events and file transfers
  4. 04Review outbound network destinations, especially anything internet-bound
  5. 05Verify project file integrity against version control

Indicators of interest

  • Remote access tooling not in the approved set
  • Scripting execution outside automation
  • Project files modified outside working hours
  • New scheduled tasks or services

Triage

  • Does the activity map to a named engineer's work?
  • Has the host contacted controllers since?
  • Are project files altered?

Likely false positives

  • Vendor support tooling
  • IT management agents
  • Engineer troubleshooting scripts

Escalation

  • Any controller contact after suspicious execution
  • Project file modification without a change record

Containment options

  • Do not wipe immediately — preserve evidence and consider process dependency; coordinate with engineering

Validation

  • Rebuild from a known-good image with engineering sign-off
  • Re-verify controller programs against the baseline

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.