Hunt playbook
Suspicious Remote Access into OT
Identify remote sessions into the OT environment that lack a named user, approval, or business justification.
FoundationalT0822T0886
Hypothesis
A remote session into OT may be occurring without approval or without a legitimate named user.
Why this hunt matters
Remote access is repeatedly documented as an initial access path into OT environments.
Scope
Assets: remote-access-gateway, jump-server, hmi, dcs
Protocols:
Data sources required
- Remote access gateway logs
- Jump host session records
- Identity provider / MFA logs
- Firewall logs at the DMZ boundary
- Change and work-order records
Baseline needed first
- Named accounts only
- Sessions during declared support windows
- Each session maps to a ticket or work order
Hunt steps
- 01List all sessions into OT for the period with identity, source, destination and duration
- 02Filter to out-of-hours, unusually long, or unusual-destination sessions
- 03Check each against approvals and work orders
- 04Verify MFA was satisfied and not bypassed by an exception path
- 05Look for direct-to-destination traffic that bypassed the jump host entirely
Indicators of interest
- Shared or generic account names
- Access from an unexpected geography or ASN
- Sessions reaching engineering or safety systems
- Bypass of the designated jump host
Triage
- Who is the human behind the account?
- What was reached and what was done?
- Was any control-affecting action taken?
Likely false positives
- Genuine emergency support
- Scheduled vendor maintenance not recorded in the ticket system
- Monitoring integrations using service accounts
Escalation
- No identifiable human
- Access to safety or engineering systems
- MFA bypass observed
Containment options
- Disable the account pending verification
- Coordinate with operations before terminating an active support session
Validation
- Vendor access set to default-off
- Bypass paths removed from firewall rules
- Session logging verified end to end
Why should I care?
Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.