Skip to main content
OT Atlas
Search

Hunt playbook

Scanning or Enumeration on OT Networks

Detect discovery behaviour inside OT networks, including protocol-specific enumeration.

IntermediateT0846T0842

Hypothesis

A host may be enumerating devices or services inside a control zone.

Why this hunt matters

Enumeration usually precedes targeting, and aggressive scanning can itself disrupt fragile devices.

Scope

Assets: plc, industrial-switch, hmi, opc-server

Protocols: modbus-tcp, profinet, profinet-dcp, bacnet, mms, ethernet-ip, s7comm

Data sources required

  • Network metadata (connection counts, fan-out)
  • Firewall denies
  • Protocol inspection for discovery functions

Baseline needed first

  • Normal per-host connection fan-out and destination counts
  • Known discovery sources such as an approved passive sensor (which should not actively probe)

Hunt steps

  1. 01Rank hosts by unique destinations contacted in the period
  2. 02Inspect high-fan-out hosts for sequential addressing or repeated failed connections
  3. 03Search for protocol discovery functions: BACnet Who-Is, PROFINET DCP Identify-All (layer 2, EtherType 0x8892 — no IP sensor will see it), CIP List Identity on 44818, S7comm CPU identification reads on 102/TCP, MMS directory browse
  4. 04Correlate with any authorised assessment activity

Indicators of interest

  • Sequential IP or unit-ID sweeps
  • High rate of connection resets
  • Discovery function bursts
  • Scanning from a server that normally has two peers

Triage

  • Is there an authorised assessment underway?
  • Did any device fault during the activity?
  • What is the scanning host and who controls it?

Likely false positives

  • Approved vulnerability assessment in a lab or agreed window
  • Network management discovery
  • Backup or monitoring tools with broad polling

Escalation

  • Scanning from a host with no management role
  • Device faults coinciding with the activity

Containment options

  • Stop the activity in coordination with operations; check device health before and after

Validation

  • Document approved discovery sources
  • Prefer passive discovery in production

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.