Skip to main content
OT Atlas

Hunt playbook

Scanning or Enumeration on OT Networks

Detect discovery behaviour inside OT networks, including protocol-specific enumeration.

IntermediateT0846T0842

Hypothesis

A host may be enumerating devices or services inside a control zone.

Why this hunt matters

Enumeration usually precedes targeting, and aggressive scanning can itself disrupt fragile devices.

Scope

Assets: plc, industrial-switch, hmi, opc-server

Protocols: modbus-tcp, profinet, profinet-dcp, bacnet, mms, ethernet-ip, s7comm

Data sources required

  • Network metadata (connection counts, fan-out)
  • Firewall denies
  • Protocol inspection for discovery functions

Baseline needed first

  • Normal per-host connection fan-out and destination counts
  • Known discovery sources such as an approved passive sensor (which should not actively probe)

Hunt steps

  1. 01Rank hosts by unique destinations contacted in the period
  2. 02Inspect high-fan-out hosts for sequential addressing or repeated failed connections
  3. 03Search for protocol discovery functions: BACnet Who-Is, PROFINET DCP Identify-All (layer 2, EtherType 0x8892 — no IP sensor will see it), CIP List Identity on 44818, S7comm CPU identification reads on 102/TCP, MMS directory browse
  4. 04Correlate with any authorised assessment activity

Indicators of interest

  • Sequential IP or unit-ID sweeps
  • High rate of connection resets
  • Discovery function bursts
  • Scanning from a server that normally has two peers

Triage

  • Is there an authorised assessment underway?
  • Did any device fault during the activity?
  • What is the scanning host and who controls it?

Likely false positives

  • Approved vulnerability assessment in a lab or agreed window
  • Network management discovery
  • Backup or monitoring tools with broad polling

Escalation

  • Scanning from a host with no management role
  • Device faults coinciding with the activity

Containment options

  • Stop the activity in coordination with operations; check device health before and after

Validation

  • Document approved discovery sources
  • Prefer passive discovery in production
Abstract node diagram showing Scanning or Enumeration on OT Networks at the centre connected to related components, protocols, hunts and incidents in the Atlas.
Everything in the Atlas is connected — follow the links below to related entries.

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.