OT & ICS Threats

What OT/ICS Threats Are and Why They Matter

• Operational Technology (OT) controls physical processes — manufacturing lines, power grids, pipelines, water treatment, building automation — through industrial control systems (ICS) like PLCs, RTUs, SCADA, and DCS.
• MITRE ATT&CK for ICS (T800 series) maps techniques specific to industrial environments, distinct from enterprise IT ATT&CK. Key categories include T838 (Modbus Function Code), T831 (Device Restart/Shutdown), and T844 (Program Download).
• The stakes are higher than IT: OT attacks can cause physical damage, safety incidents (fires, explosions, toxic releases), environmental damage, and extended production outages.
• The traditional “air gap” between IT and OT networks is eroding — modern ICS uses IT connectivity for remote monitoring, firmware updates, and data analytics, creating attack paths that did not exist before.

Historic OT/ICS Attacks — Lessons for Analysts

Stuxnet (2010) — The Game Changer

TRITON/TRISIS (2017) — Safety System Attack

Colonial Pipeline (2021) — IT-to-OT Disruption (linked to ransomware and DDoS patterns)

PLC Attacks — Manipulating Industrial Controllers

Programmable Logic Controllers (PLCs) are the brains of industrial automation. They read sensors and control actuators based on a logic program (ladder logic, structured text, function block diagram).

Attack Vectors

Authentication Gaps in PLCs (a common insider threat vector)

Detection — PLC Program Change

index=ot sourcetype=plc_log
| search action="program_upload" OR action="firmware_update" OR action="config_change"
| stats count, values(action) as Actions by plc_name, source_ip
| where count > 0
| eval alert = "PLC configuration change on " . plc_name . " from " . source_ip . " — verify authorized"
| table _time, plc_name, source_ip, Actions, count, alert

MODBUS Protocol — The Insecure Standard

MODBUS is the most widely deployed industrial protocol. It was designed in 1979 and has no security built in. MODBUS TCP runs on port 502.

MODBUS Function Codes

MODBUS Anomaly Detection

SPL — detect unauthorized MODBUS writes:

index=ot sourcetype=modbus
| search function_code IN (05, 06, 15, 16, 22)
| lookup modbus_device_acl.csv plc_ip, src_ip OUTPUT authorized
| where authorized != "yes"
| eval alert = "UNAUTHORIZED MODBUS WRITE — " . function_name . " (function " . function_code . ") from " . src_ip . " to PLC " . plc_ip . " at register " . register_address
| table _time, src_ip, plc_ip, function_code, function_name, register_address, value, alert

Suricata rule — detect MODBUS scanning (and other API-level protocol attacks):

alert tcp any any -> any 502 (msg:"MODBUS — Holding Register Read Scan"; 
  content:"|00 03 00 00 00 06 01|"; offset:0; depth:7; 
  content:"|03|"; within:1; distance:5; 
  threshold: type both, track by_src, count 10, seconds 60;
  sid:1000001; rev:1;)

The Purdue Model — Understanding OT Network Segmentation

The Purdue Enterprise Reference Architecture (PERA) defines levels of industrial network hierarchy:

Where Attacks Happen

Most OT attacks cross levels:

• IT-to-L3: Ransomware enters through IT, reaches Level 3 via shared domain or jump box
• L3-to-L1: Compromised engineering workstation downloads malicious PLC program
• Direct L0: Physical access to sensors or actuators (tampering)

Detection for OT Environments

OT-Specific Detection Rules

SPL — OT-IT Boundary Monitoring

index=ot sourcetype=netflow
| search src_ip=10.0.* OR dst_ip=10.0.*
| search src_ip=172.16.* OR dst_ip=172.16.*
| stats sum(bytes) as total_bytes, count by src_ip, dst_ip, dest_port
| where total_bytes > 1000000
| eval alert = "Large data transfer across OT-IT boundary: " . src_ip . " → " . dst_ip . ":" . dest_port . " — " . round(total_bytes/1024/1024, 2) . " MB"
| table _time, src_ip, dst_ip, dest_port, total_bytes, alert
| sort - total_bytes

Defensive Controls

Related

• Container and Kubernetes Threats — detection and response for T1611, T1525, T1574.002 techniques
• Cloud Threats — Credential Theft, IMDS Abuse, Hijacking, Privilege Escalation — detection and response for T1525, T1552, T1613 techniques
• Snort and Suricata — detection and response for T1040 techniques
• Network Security Basics — detection and response for T1040, T1046 techniques

Sources

• MITRE ATT&CK for ICS
• CISA — ICS Advisories
• TRITON/TRISIS — FireEye Analysis
• Colonial Pipeline — CISA Report
• Stuxnet — SANS Analysis
• SANS — Purdue Model for ICS Security
• Claroty — MODBUS Security