Search the atlas

One box across protocols, components, vendors, industries, incidents, hunts, techniques and guides — narrowed by the protocol on your wire and the component it runs on.

Search the atlasOT protocolAsset type

309 entries indexed

VendorABBDCS, Substation automation, Drives, Robotics, PLC, Electrification HuntAbnormal Authentication in OTIdentify authentication patterns in the OT environment that do not match normal operational behaviour.HuntAbnormal HMI CommunicationDetect HMIs communicating with unusual peers, services or destinations.HuntAbnormal RDP usageRDP is being used along a path or at a time that does not match administrative practice.HuntAbnormal SSH usageSSH sessions are reaching Linux-based OT infrastructure from unexpected sources or accounts.HuntAccount used from a new hostA valid account authenticated from a host it has never used before.HuntAccount used outside the expected maintenance windowAn account with a strictly scheduled purpose was used outside its window.AssetActuator / Final ElementLevel 0 GlossaryAdvisoryA vendor or agency publication describing affected products, impact and recommended mitigations.GlossaryAir gapThe idea of complete physical isolation. In practice it degrades through media, laptops and vendor connectivity, and should not be relied on as a sole control.Threat groupALLANITEDragos · OT-focused access ProtocolAMQP5672/TCP (plain), 5671/TCP (TLS) · Open / standardized Vuln classAuthentication BypassAccess is possible without presenting valid credentials.VendorAVEVASCADA, HMI software, Historian, MES Threat groupAZURITEDragos · OT-focused access GuideBackup & RecoveryBe able to restore OT operations from validated, protected backups.ProtocolBACnet47808/UDP (BACnet/IP) · Open / standardized ProtocolBACnet/IP47808/UDP (0xBAC0) · Open / standardized Threat groupBAUXITEDragos · OT-focused access HuntBeacon-like periodic connectionsA host is contacting a destination at a regular interval consistent with automated check-in.VendorBeckhoffPC-based control, EtherCAT, Motion ProtocolBeckhoff ADS/AMS48898/TCP · Vendor-associated Threat groupBENTONITEDragos · IT access with OT relevance GlossaryBPCSBasic Process Control System Vuln classBuffer Overflow / Memory CorruptionMalformed input corrupts memory, causing a crash or potentially code execution.IndustryBuilding AutomationHVAC, lighting, access and fire systems — frequently the least segmented OT in an organisation.ProtocolCAN busN/A · Open / standardized ProtocolCANopenN/A · Industry consortium IndustryChemicalContinuous and batch chemical production with significant process hazards and rigorous safety layers.Threat groupCHERNOVITEDragos · Stage 2 ICS effects Threat groupCHRYSENEDragos · IT access with OT relevance GlossaryCIPCommon Industrial Protocol ProtocolCIP (Common Industrial Protocol)Depends on carrier · Industry consortium ProtocolCIP SafetyCarrier dependent · Industry consortium FrameworkCISA ICS GuidanceAdvisories, alerts and recommended practices for industrial control systems, including defense-in-depth and incident response material.Vuln classCleartext CredentialsCredentials traverse the network or are stored without protection.IncidentColonial Pipeline Ransomware2021 · Indirect operational impact Vuln classCommand InjectionUntrusted input is passed to a system command interpreter.ToolCommunication matrix builderDocument zones, conduits and every flow crossing the OT boundary GlossaryCompensating controlAn alternative control applied when the primary remediation (usually patching) is not feasible.GlossaryConduitA defined, controlled communication path between zones, carrying only approved flows.GlossaryCPSCyber-Physical System GlossaryCVECommon Vulnerabilities and Exposures GlossaryCVSSCommon Vulnerability Scoring System GlossaryCWECommon Weakness Enumeration AssetData Acquisition ServerLevel 2 – Level 3 IndustryData CentersFacility infrastructure — power, cooling and monitoring — that underpins digital services and is itself an OT environment.GlossaryDCSDistributed Control System Vuln classDefault CredentialsDevices ship with well-known credentials that are never changed.HuntDefault Credentials and Internet-Exposed Field DevicesFind control devices that are reachable from the internet or still using factory-default credentials, before an opportunistic actor does.GlossaryDefense in depthLayering independent controls so that the failure of one does not expose the process.Vuln classDenial of ServiceThe device or service can be made unavailable.ProtocolDeviceNetN/A · Industry consortium AssetDistributed Control SystemDCS · Level 2 – Level 1 ProtocolDNP320000/TCP (commonly) · Open / standardized GlossaryDNP3A telemetry protocol used widely in electric and water utilities, with optional Secure Authentication.HuntDNS anomaliesDNS is being used as a command-and-control or exfiltration channel from an OT-supporting network.AssetDomain Controller in OTLevel 3 Threat groupDYMALLOYDragos · OT-focused access IndustryElectric PowerGeneration, transmission and distribution, where protection schemes operate in milliseconds and outages have public consequences.Threat groupELECTRUMDragos · Stage 2 ICS effects VendorEmersonDCS, Instrumentation, Asset management, Safety AssetEngineering WorkstationEWS · Level 2 – Level 3 HuntEngineering workstation communicating externallyAn engineering workstation has direct or proxied internet egress.HuntEngineering Workstation CompromiseHunt for signs that an engineering host has been compromised before it is used to change a controller.GuideEngineering Workstation ProtectionTreat engineering hosts as the highest-value endpoints in the environment.GlossaryEPSSExploit Prediction Scoring System ProtocolEtherCATN/A — Layer 2 · Industry consortium ProtocolEtherNet/IP44818/TCP (explicit), 2222/UDP (implicit I/O) · Industry consortium GlossaryEWSEngineering Workstation Vuln classExposed Management ServicesWeb, SSH, Telnet or vendor management services reachable beyond their intended scope.AssetField DeviceLevel 0 GlossaryFieldbusA digital communication network connecting field devices to controllers, such as PROFIBUS or FOUNDATION Fieldbus.HuntFirewall policy path unexpectedly exercisedA permissive firewall rule that normally sees no traffic has started being used.HuntFirst-seen executable hashAn executable never before observed in the environment appeared on an OT-supporting host.IndustryFood & BeverageHigh-throughput production lines with strong hygiene requirements and heavy OEM machine content.ProtocolFOUNDATION FieldbusN/A / Ethernet for HSE · Industry consortium Threat groupGANANITEDragos · IT access with OT relevance VendorGE VernovaGrid automation, SCADA, Power generation controls AssetGeneric ControllerLevel 1 ProtocolGOOSEN/A — EtherType 0x88B8 · Open / standardized GlossaryGOOSEIEC 61850 Layer 2 multicast messaging carrying time-critical protection signals between substation devices.Threat groupGRAPHITEDragos · IT access with OT relevance Vuln classHardcoded CredentialsCredentials are embedded in firmware or software and cannot be changed by the operator.ProtocolHARTN/A — field wiring · Industry consortium ProtocolHART-IP5094 (TCP/UDP) · Industry consortium IndustryHealthcare / Medical CPSClinical devices and hospital facility systems where patient safety and continuity of care dominate.Threat groupHEXANEDragos · IT access with OT relevance GlossaryHistorianA time-series database storing process values, events and alarms for analysis and reporting.HuntHistorian communicating with an unknown internet hostA process historian is exchanging data with an external destination that is not an approved service.HuntHistorian Data ExfiltrationDetect abnormal bulk extraction of process data from historians or reporting systems.GlossaryHMIHuman-Machine Interface VendorHoneywellDCS, Safety, Building automation, Instrumentation AssetHuman-Machine InterfaceHMI · Level 2 GlossaryICSIndustrial Control System GuideIdentity & Privileged AccessEnsure every action in OT is attributable to a person and privileges are minimal and time-bound.GlossaryIDMZIndustrial DMZ ProtocolIEC 60870-5-101N/A — serial · Open / standardized ProtocolIEC 60870-5-1042404/TCP · Open / standardized ProtocolIEC 61850102/TCP for MMS; GOOSE and SV are Layer 2 · Open / standardized FrameworkIEC 62443A series of standards for industrial automation and control system security covering asset owners, integrators and product suppliers.GlossaryIEDIntelligent Electronic Device GlossaryIIoTIndustrial Internet of Things AssetIIoT Edge GatewayLevel 3.5 and above Vuln classImproper Access ControlFunctions are reachable by users or peers that should not be authorised for them.Vuln classImproper Input ValidationThe device or application accepts input it should reject.VendorInductive AutomationSCADA / HMI software, MQTT-based architectures GuideIndustrial DMZEnsure no traffic passes directly between the enterprise and control environments.AssetIndustrial Ethernet SwitchLevel 2 – Level 0 AssetIndustrial FirewallLevel 3.5 / zone boundaries HuntIndustrial Protocol Write ActivitySurface write operations on industrial protocols and confirm each has an operational reason.IncidentIndustroyer / CrashOverride2016 · Direct OT impact Vuln classInsecure FirmwareFirmware contains known-vulnerable components or weak protections.Vuln classInsecure Update MechanismsThe update process itself lacks integrity or authenticity controls.AssetIntelligent Electronic DeviceIED · Level 1 VendorJohnson ControlsBuilding automation, Fire and security systems GlossaryJump hostA hardened intermediate system that all interactive access into a protected zone must traverse.AssetJump Server / BastionLevel 3.5 Threat groupKAMACITEDragos · IT access with OT relevance GlossaryKEVKnown Exploited Vulnerabilities

Showing the first 120 of 309 matches — narrow with a term or a filter to see the rest.