PLAYBOOKS NET HOST ATTRIB DETECT
← all playbooks
ENVIRONMENT
ICS / SCADA / OT
Industrial control systems, SCADA networks, and operational technology environments where cyber compromise can cause physical consequences. PLCs, HMIs, engineering workstations, and ICS protocols that were designed for reliability in environments that were never expected to be connected to adversary networks.
Purdue Level 0-3 · ICS protocols (Modbus, DNP3, S7comm, OPC UA) · host + network detection · physical process integrity
Why this environment is different

An air-gapped OT network inverts the normal detection model. On a connected enterprise network, you hunt for known-bad. On an isolated network, any external communication is the indicator. DNS to 8.8.8.8, an HTTP request to any public IP, a package manager trying to reach a repo: these should never happen and their presence is proof of either a misconfiguration or a compromise.

The constraints are real: most OT hosts can't run EDR agents. Sysmon may not be installable on HMIs or historians running legacy OS. Cloud-dependent detection (CrowdStrike, Defender for Endpoint) has no backend to call. Your telemetry sources are network captures (Zeek, Suricata, Arkime on a span port), host logs where available (Windows Event Logs, Sysmon on engineering workstations), and ICS-aware protocol inspection. Everything else is a manual check.

Change is infrequent and tightly controlled. A new binary, a new network connection, a new service, a new user account: any of these outside a scheduled maintenance window is suspicious by default. The baseline is your strongest asset because it barely moves.

Tripwires: should never exist on this network

If you see any of these on an air-gapped OT segment, stop and investigate immediately. These are not "suspicious." They are proof that the isolation assumption is broken.

Hunt checklist: prioritized

Work top to bottom. The first items catch the most common intrusion paths into OT environments. Lower items catch later-stage activity or more sophisticated techniques.

  1. 1. Engineering workstation integrity The EWS is the bridge between IT and OT. If it's compromised, the attacker has a path to the controllers. Check for: unauthorized software installs, process allowlist violations (Sysmon EID 1 for anything not in the baseline), new services, new scheduled tasks, USB mount artifacts. This is the single highest-value host to audit. HOST: Execution · Persistence · Discovery
  2. 2. Removable media indicators USB is the primary initial access vector for air-gapped networks (Stuxnet, Agent.BTZ, Raspberry Robin). Hunt for: new files in known USB mount paths, autorun.inf creation, executables in removable media root, Sysmon EID 11 (FileCreate) on removable volumes, Windows Event 4663 (Object Access) on removable storage. HOST: Execution (T1204.002 User Execution)
  3. 3. ICS protocol anomalies Unauthorized commands on Modbus (write-coil, write-register from a non-EWS source), DNP3 (cold restart, firmware download), S7comm (PLC stop/start, program upload), EtherNet/IP (config changes, I/O writes from new sources). Any write command from an IP that isn't the authorized engineering workstation is high-confidence malicious. NET: Arkime/Zeek/Suricata ICS protocol parsers · Modbus TCP/502 · DNP3/20000 · S7comm/102
  4. 4. Network baseline deviation New host-to-host communication pairs that didn't exist in the baseline. On an air-gapped OT network, the communication matrix is nearly static. A new connection between two hosts that have never talked before is either a misconfiguration or lateral movement. Zeek conn.log diff against baseline. NET: Zeek conn.log baseline comparison · Arkime sessions
  5. 5. Authentication anomalies New accounts created, privilege escalation (user added to admin group), failed authentication spikes, logon type anomalies (type 10 RDP where RDP shouldn't be used, type 3 network logon from unexpected sources). On OT, the user list is small and stable. Any new account is suspicious. HOST: Credential Access · Privilege Escalation · Security EID 4720/4632/4624
  6. 6. Persistence mechanisms New services, scheduled tasks, cron jobs, systemd units, registry Run keys. On a static OT environment, the persistence baseline doesn't change between maintenance windows. Anything new was either installed during authorized maintenance (verify against the change log) or planted by an attacker. HOST: Persistence (all techniques)
  7. 7. Lateral movement between zones SMB, RDP, SSH, or WMI between Purdue levels that shouldn't communicate directly. Level 3 (site operations) talking to Level 1 (basic control) without going through Level 2 (area supervisory) is a zone violation. Level 0 (process) should never see interactive logons. HOST: Lateral Movement · NET: SMB/RDP/SSH cross-zone flows
  8. 8. PLC project file changes Modification of PLC project files (.s7p, .acd, .mer, .rss) outside a maintenance window or by a non-engineering account. Sysmon EID 11 (FileCreate) or FIM on project directories. This is the canary for controller-targeting activity: if the attacker is modifying PLC logic, they're past reconnaissance and into the impact phase. HOST: Sysmon EID 11 FIM on project directories · Impact
  9. 9. Historian and HMI config changes Unauthorized queries to PI, Wonderware, iFIX databases. HMI screen modifications, tag value overrides, or alarm suppression outside maintenance windows. Historian access from a non-authorized source IP. These changes can mask process manipulation. Application-specific logging · Database audit logs · HMI change management
  10. 10. Data staging and collection Archive creation (zip, tar, rar), large file copies to writable shares, files moved to USB mount paths. On an air-gapped network, exfiltration requires physical media. Staging to removable-accessible paths is the pre-exfil indicator. HOST: Impact · Sysmon EID 11 on removable media paths
Available tools (no internet required)

These work fully offline. No cloud backend, no signature updates from the internet, no license phone-home.

Zeek + Suricata
Network monitoring on a span port. Zeek logs conn, dns, http, modbus, dnp3, s7comm. Suricata runs ET SCADA rules. Both are the primary detection source on air-gapped OT.
Arkime
Full packet capture and indexed search. The forensic record when you need to reconstruct exactly what happened on the wire.
Sysmon (Windows)
Install on engineering workstations and any Windows host that can support it. EID 1 (process), 3 (network), 7 (image load), 11 (file create), 13 (registry). Runs locally, no cloud dependency.
Auditd (Linux)
Kernel-level syscall auditing. execve monitoring, file access watches on /etc/shadow and SSH keys, network socket creation. The Linux equivalent of Sysmon.
osquery
Scheduled SQL queries against the host: processes, listening ports, file integrity, kernel modules, cron jobs, authorized_keys. Runs locally, ships results to local collector.
YARA
Signature scanning of files and processes. Rules can be updated via sneakernet. Catches known malware on disk and in memory without needing a cloud AV backend.
Cloud EDR (unavailable)
CrowdStrike, Defender for Endpoint, SentinelOne all require cloud connectivity for behavioral detection. They will not function on an air-gapped segment. Do not rely on them here.
Cloud SIEM (unavailable)
Splunk Cloud, Elastic Cloud, Microsoft Sentinel cannot receive logs from an air-gapped network. Use local Elastic/Kibana, Security Onion, or Malcolm for log aggregation.
Note on Purdue levels. This playbook targets Levels 2-3 (area supervisory and site operations), where Windows/Linux hosts exist and can run monitoring tools. Levels 0-1 (process and basic control: PLCs, RTUs, actuators) generally cannot run host-based agents. Detection at those levels is network-only: Zeek/Suricata on a span port monitoring the ICS protocol traffic. Level 4+ (IT/DMZ) has full enterprise tooling and is covered by the standard host and network playbooks.
The visibility gap (Dragos 2026). Fewer than 10 percent of OT networks worldwide have network visibility and monitoring in place. 90 percent of Dragos customers cannot detect the style of attack that ELECTRUM used against Ukraine's power grid in 2015. 30 percent of Dragos IR cases in 2025 started not with a detection but with someone saying "something seems wrong," and in the majority of those cases, the data needed to determine whether cyber was involved had never been collected. OT network telemetry is transient. If you are not recording it when it happens, it is gone.
OT consequences extend beyond downtime. In pharmaceutical manufacturing, a cyber incident doesn't just halt a production line. It can invalidate GMP batch records, trigger FDA re-validation requirements, and compromise product integrity in ways that require product recalls and loss of manufacturing authorization. In water treatment, unauthorized parameter changes can affect chemical dosing ratios with public health consequences. In energy, loss of visibility can mask physical process failures until they cascade. The impact model in OT is not "how long until we restore service." It is "what happened to the physical process while we couldn't see it, and can we prove the output is still safe."
Active: joint advisory on Russian APT router campaigns (July 2026). US and allied intelligence agencies warned that multiple Russian state-sponsored groups are actively compromising poorly secured routers embedded in critical infrastructure networks, using LOTL techniques to maintain long-term access across OT-adjacent segments. This reinforces the KAMACITE and VOLTZITE router campaigns documented by Dragos. Organizations running aging or misconfigured edge devices in energy, water, and transport should treat this as an urgent hardening signal.
ICS-specific attack tools in the wild (2025)

ICS protocols were designed for reliability in environments that were never expected to be connected to outside networks. They lack authentication, they are well documented, and their protocol libraries are publicly available. Building a tool that sends a command to a PLC does not require the resources of a state program. It requires documentation and a reason to try. More actors now have both.

PLC_Controller.exe. Discovered July 2025 (Dragos). Compiled Python tool that issues S7comm and COTP requests to force older Siemens S7-300/S7-400 PLCs into STOP mode. 45 percent of S7 PLC devices in the Dragos Intelligence Fabric are vulnerable older models. Dragos assesses with moderate confidence the tool was used in a national red team exercise coordinated by China's Ministry of Public Security. The capability is fully functional and immediately operationalizable.

Modbus PowerShell tool (exploit.ps1). Discovered November 2025 (Dragos). Scans for Modbus servers on a subnet, identifies holding registers with values greater than 400, and repeatedly writes 1,000 to the holding register. Found alongside a customized Slowloris DDoS tool with botnet functionality.

Hacktivist ICS targeting. In 2025, hacktivist groups moved beyond symbolic defacements into direct ICS interaction. Dragos observed exploitation of internet-facing HMIs, misconfigured engineering workstations, exposed Modbus/TCP, DNP3, MQTT, OPC UA endpoints, and BACnet devices. Groups like Z-Pentest and Dark Engine used open-source scanning tools to identify PLC gateways and historian servers. Some campaigns used Cobalt Strike, Sliver C2, and LOTL techniques, reflecting a maturation well beyond their traditional capability.

Adversaries are mapping control loops (2025)

The most significant finding in the Dragos 2026 report: adversaries are no longer simply gaining access and waiting. Multiple threat groups, independently and across different geopolitical alignments, moved into actively mapping control loops: identifying engineering workstations, exfiltrating configuration files and alarm data, and learning how physical processes operate well enough to disrupt them. This is the removal of the last practical barrier between having access and being able to cause physical consequences.

KAMACITE (Sandworm access team) scanned US-exposed industrial devices from March through July 2025: Schneider Electric Altivar variable-frequency drives, Smart HMIs, Accuenergy AXM modules, and Sierra Wireless Airlink gateways. The scanning was not opportunistic. It targeted specific components in a sequence that suggests intent to understand entire control loops: operator interfaces (HMIs), actuators that influence physical processes (VFDs), metering and process-visibility points (AXM modules), and remote-access gateways that bridge ICS back to corporate networks (Airlink). "The pattern is consistent with what you would expect from a team being told to prepare for operations, not just collect."

VOLTZITE (overlaps Volt Typhoon) achieved Stage 2 capability in 2025 by moving beyond data exfiltration to direct manipulation of engineering workstations. They compromised Sierra Wireless Airlink RV50/RV55 cellular gateways in electric and oil and gas, pivoted to engineering workstations, and "manipulated the software to dump configuration files and alarm data to investigate what would trigger operational processes to stop." VOLTZITE also exploited Trimble Cityworks GIS software to steal data about the layout and architecture of energy systems.

AZURITE (new, overlaps Flax Typhoon) targets OT engineering workstations and exfiltrates operational data: alarm data, configuration files, process information, and employee operator information. They demonstrate knowledge of OT-centric software and conduct interactive operations to identify information of interest. Dragos assesses this activity supports capability development and target designation for offensive operations in case of geopolitical conflict. Targets manufacturing, automotive, electric, oil and gas, pharma, and defense across the US, Australia, Europe, Japan, South Korea, and Taiwan.

Sierra Wireless Airlink: the OT edge device to watch. Both VOLTZITE and KAMACITE targeted Sierra Wireless Airlink cellular gateways in 2025. These devices connect field equipment to cellular networks for remote monitoring and management. The risks: they bypass network perimeter controls via cellular, IT security teams may not know they exist, they connect to legacy OT equipment without security features, and they're often in physically accessible remote locations. If you have Airlink devices in your environment, audit them now.
Actors who target this environment

Sandworm / ELECTRUM + KAMACITE remains the primary threat. ELECTRUM expanded beyond Ukraine into Poland in December 2025, targeting combined heat and power facilities and renewable energy management systems: the first major cyberattack against distributed energy resources anywhere in the world. KAMACITE expanded from Ukrainian targets into the European OT supply chain AND conducted sustained US ICS reconnaissance. New PathWiper malware identified June 2025 with another variant in December 2025. "The most operationally experienced infrastructure-attack group Dragos is aware of."

Volt Typhoon / VOLTZITE + SYLVANITE now operates in a paired model. SYLVANITE provides initial access by rapidly weaponizing edge device vulnerabilities (Ivanti, F5, SAP, ConnectWise) and hands off compromised environments to VOLTZITE within days. VOLTZITE achieved Stage 2 in 2025 through direct EWS manipulation and control-loop data theft. This division of labor compresses the timeline from breach to operational readiness from weeks to days.

AZURITE (new, Flax Typhoon overlap) targets engineering workstations to exfiltrate operational data for capability development. Uses compromised SOHO routers for C2, exploits the same edge device CVEs as SYLVANITE and VOLTZITE, and operates across manufacturing, defense, automotive, electric, oil and gas, and government sectors.

PYROXENE (new, IRGC-CEC/APT35 overlap) conducts supply chain compromises targeting defense, transportation, and critical infrastructure. Deployed wiper malware against Israeli targets in June 2025 during the Iran-Israel conflict. Conducted watering-hole attacks against a water utility serving Haifa Bay Port. Operates with initial access provided by PARISITE.

BAUXITE (CyberAv3ngers, IRGC-CEC) escalated from hacktivist-level operations to deploying custom wiper malware against Israeli targets in June 2025. Previously compromised Unitronics PLCs at US water facilities (2023) and over 400 global OT devices via IOControl malware. Sends threatening emails to ICS vendors, security researchers, and OT stakeholders.

APT41 conducts dual-purpose operations across IT and OT, targeting manufacturing and technology sectors where OT networks hold intellectual property and process data.