Skip to main content
OT Atlas
Search

Hunt playbook

Rogue Master or Controlling Station

Detect an additional master, controlling station or publisher issuing commands on an industrial protocol.

AdvancedT0855T0836

Hypothesis

A second, unauthorised master may be communicating with field devices.

Why this hunt matters

Most industrial protocols trust any peer that can reach them; an extra master is functionally an unauthorised operator.

Scope

Assets: rtu, ied, plc, scada-server

Protocols: dnp3, iec-60870-5-104, modbus-tcp, goose, iec-61850

Data sources required

  • Passive protocol inspection
  • Firewall and switch logs
  • SCADA front-end processor logs
  • Device connection tables

Baseline needed first

  • One controlling station per outstation, with documented addresses and IPs
  • A fixed GOOSE publisher inventory

Hunt steps

  1. 01Build a table of every source that initiated master-role traffic per outstation
  2. 02Compare against the documented master inventory
  3. 03For GOOSE/Layer 2 protocols, compare publisher MAC/appID sets against the baseline
  4. 04Review the timing of any new peer against maintenance activity
  5. 05Correlate command activity with operator action records

Indicators of interest

  • New master IP or address
  • Duplicate publisher identifiers
  • Commands with no corresponding operator action
  • Device connection-table growth

Triage

  • Is the peer a known test set or engineering tool?
  • Did any process change follow?
  • Which zone did the traffic originate in?

Likely false positives

  • Protection test sets during commissioning
  • Redundant SCADA failover events
  • Temporary engineering connections

Escalation

  • Command traffic from an unknown peer
  • Any switching or actuating command not tied to an operator

Containment options

  • Work with operations to confirm field state before acting
  • Restrict the conduit to documented masters

Validation

  • Master inventory documented and enforced at the conduit
  • Alerting created for new peers

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.