Hunt playbook
New Device in a Control Zone
Identify devices that appeared in a control zone without a corresponding project or work order.
FoundationalT0842T0864
Hypothesis
One or more devices in a control zone are not in the approved inventory.
Why this hunt matters
Unexpected devices may be test equipment, a contractor laptop, or an attacker's foothold — and all three matter.
Scope
Assets: industrial-switch, plc, terminal-server
Protocols: profinet, profinet-dcp, ethernet-ip, goose
Data sources required
- Passive asset discovery
- Switch MAC and ARP tables
- DHCP logs
- Asset inventory
- Work orders
Baseline needed first
- A current asset inventory per zone with MAC/IP and owner
Hunt steps
- 01Extract the observed device list per zone for the period
- 02Diff against the asset inventory
- 03For each new device, identify vendor OUI, protocols spoken and peers contacted
- 04Check work orders and project schedules for planned installations
- 05Physically locate the device via switch port mapping where necessary
Indicators of interest
- Consumer or unexpected vendor OUIs
- Devices speaking programming protocols
- Devices with both control-zone and external connectivity
- A new MAC address issuing PROFINET DCP Identify broadcasts on a Siemens cell — visible only to a layer-2 sensor
Triage
- Where is it physically connected?
- What has it communicated with?
- Who owns it?
Likely false positives
- Planned commissioning
- Spare devices energised for testing
- Redundant hardware failing over
Escalation
- A dual-homed device bridging zones
- A device contacting controllers with write operations
Containment options
- Coordinate with site engineering before disabling a switch port
Validation
- Inventory updated
- Unused ports disabled
- Discovery alerting enabled
Why should I care?
Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.