Hunt playbook
Unexpected IT-to-OT Communication
Find traffic crossing the IT/OT boundary that is not part of the approved communication matrix.
IntermediateT0866T0885
Hypothesis
Flows exist across the IT/OT boundary that are not in the approved matrix.
Why this hunt matters
Boundary drift is how flat networks re-emerge; each undocumented flow is an attack path.
Scope
Assets: industrial-firewall, historian, opc-server, domain-controller-ot
Protocols: opc-classic, opc-ua, modbus-tcp, mqtt
Data sources required
- Boundary firewall logs (permitted and denied)
- Network metadata from the DMZ and control zone
- Approved communication matrix
Baseline needed first
- An approved matrix of source, destination, protocol, port and purpose
Hunt steps
- 01Extract permitted flows crossing the boundary for the period and aggregate by source/destination/service
- 02Diff against the approved matrix
- 03For each unmatched flow, identify the application and owner
- 04Check whether the flow terminates in the DMZ as designed or reaches the control zone directly
- 05Review denied traffic for signs of repeated attempts
Indicators of interest
- Enterprise hosts speaking industrial protocols
- Control-zone hosts reaching internet destinations
- Flows that skip the DMZ
- Broad any/any rule usage
Triage
- Is the flow operationally required?
- Can it be terminated in the DMZ instead?
- Who authorised the rule and when?
Likely false positives
- Backup and management traffic not captured in the matrix
- Temporary project flows
- Monitoring agents
Escalation
- Direct enterprise-to-controller traffic
- Any inbound flow to a safety zone
Containment options
- Plan rule removal with the flow owner; avoid breaking operational dependencies abruptly
Validation
- Matrix updated
- Rules recertified
- Detection created for future undocumented flows
Why should I care?
Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.