Skip to main content
OT Atlas
Search

Hunt playbook

Unexpected Internet Connectivity from OT

Find OT assets communicating with internet destinations, inbound or outbound.

FoundationalT0822T0884

Hypothesis

One or more OT assets may have direct internet connectivity.

Why this hunt matters

Directly reachable OT devices are repeatedly identified in advisories as a leading cause of real incidents.

Scope

Assets: plc, hmi, iiot-gateway, terminal-server, remote-access-gateway

Protocols: modbus-tcp, bacnet-ip, mqtt, knx

Data sources required

  • Boundary firewall logs
  • NetFlow / network metadata
  • External attack-surface data
  • DNS logs

Baseline needed first

  • No direct internet connectivity from control zones; all external flows terminate in the DMZ

Hunt steps

  1. 01Query boundary logs for control-zone sources with external destinations
  2. 02Query for inbound connections reaching OT address space
  3. 03Review external attack-surface data for exposed industrial services on organisation-owned ranges
  4. 04Trace each finding to a device, owner and business reason

Indicators of interest

  • Controller ports reachable externally
  • Cloud service calls from control hosts
  • Cellular gateway traffic outside the DMZ

Triage

  • Is the flow required for operations?
  • Can it be moved into the DMZ?
  • Is authentication and encryption in place?

Likely false positives

  • Approved vendor telemetry through the DMZ
  • NTP and licensing calls from Level 3 systems

Escalation

  • Any inbound reachability to a controller
  • Unauthenticated exposed industrial service

Containment options

  • Remove exposure with the asset owner; a sudden block can break a monitored process

Validation

  • External exposure re-checked
  • DMZ termination implemented
  • Alerting created

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.