Skip to main content
OT Atlas

Hunt playbook

Rogue Master or Controlling Station

Detect an additional master, controlling station or publisher issuing commands on an industrial protocol.

AdvancedT0855T0836

Hypothesis

A second, unauthorised master may be communicating with field devices.

Why this hunt matters

Most industrial protocols trust any peer that can reach them; an extra master is functionally an unauthorised operator.

Scope

Assets: rtu, ied, plc, scada-server

Protocols: dnp3, iec-60870-5-104, modbus-tcp, goose, iec-61850

Data sources required

  • Passive protocol inspection
  • Firewall and switch logs
  • SCADA front-end processor logs
  • Device connection tables

Baseline needed first

  • One controlling station per outstation, with documented addresses and IPs
  • A fixed GOOSE publisher inventory

Hunt steps

  1. 01Build a table of every source that initiated master-role traffic per outstation
  2. 02Compare against the documented master inventory
  3. 03For GOOSE/Layer 2 protocols, compare publisher MAC/appID sets against the baseline
  4. 04Review the timing of any new peer against maintenance activity
  5. 05Correlate command activity with operator action records

Indicators of interest

  • New master IP or address
  • Duplicate publisher identifiers
  • Commands with no corresponding operator action
  • Device connection-table growth

Triage

  • Is the peer a known test set or engineering tool?
  • Did any process change follow?
  • Which zone did the traffic originate in?

Likely false positives

  • Protection test sets during commissioning
  • Redundant SCADA failover events
  • Temporary engineering connections

Escalation

  • Command traffic from an unknown peer
  • Any switching or actuating command not tied to an operator

Containment options

  • Work with operations to confirm field state before acting
  • Restrict the conduit to documented masters

Validation

  • Master inventory documented and enforced at the conduit
  • Alerting created for new peers
Abstract node diagram showing Rogue Master or Controlling Station at the centre connected to related components, protocols, hunts and incidents in the Atlas.
Everything in the Atlas is connected — follow the links below to related entries.

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.