Hunt playbook
New Engineering Workstation Appears
Find hosts newly behaving like engineering workstations — running engineering software or speaking programming protocols.
FoundationalT0843T0864
Hypothesis
A host not designated as an engineering workstation may have gained engineering capability.
Why this hunt matters
An attacker rarely needs new tooling; installing legitimate engineering software on an existing host is enough.
Scope
Assets: engineering-workstation, plc, jump-server
Protocols: s7comm, ethernet-ip, ads-ams
Data sources required
- Network metadata
- Endpoint process execution logs
- Software inventory
- Asset inventory
Baseline needed first
- A documented list of engineering hosts per site and per platform
Hunt steps
- 01Query for hosts executing engineering software binaries in the period
- 02Query network data for hosts initiating controller programming protocols
- 03Compare both lists to the approved engineering inventory
- 04For each unexpected host, review installation time, installing account, and subsequent controller contact
Indicators of interest
- Engineering software installed on an operator station or general laptop
- A jump host suddenly speaking controller protocols
- Portable media used before installation
Triage
- Who installed it and why?
- Has it contacted any controller?
- Is the host managed and patched?
Likely false positives
- Legitimate project work by contractors
- Software deployed by a management platform
- Engineering laptops rebuilt with new hostnames
Escalation
- Installation by an account that should not perform engineering work
- Any controller contact from the host
Containment options
- Remove unnecessary engineering software after confirming with engineering
- Constrain the host's network path
Validation
- Inventory updated
- Software allow-listing reflects the approved engineering set
Why should I care?
Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.