What problem does it solve?
Traditional IT security tools miss attacks targeting industrial control systems because they lack awareness of OT protocols like Modbus, DNP3, S7comm, and IEC 104. This Skill provides detection workflows for identifying MITM attacks, unauthorized PLC command injection, HMI compromise, historian data manipulation, and known ICS malware such as TRITON, Industroyer, and PIPEDREAM.
Core Features & Use Cases
- SCADA Traffic Baselining: Build deterministic baselines of Modbus/TCP communication pairs, function codes, polling intervals, and register ranges from pcap captures using a Python/Scapy analyzer.
- OT Detection Rules: Deploy Suricata rules for unauthorized Modbus writes, S7comm CPU STOP commands, DNP3 cold restarts, broadcast writes, and port scans targeting industrial protocols.
- Process Anomaly Detection: Monitor historian data for out-of-range values, rate-of-change violations, flatlined sensors (Stuxnet-style replay attacks), and statistical anomalies.
- Use Case: An OT security team receives an alert about TriStation traffic to a Triconex safety controller from an unauthorized IP. Use this Skill to verify the source, capture forensic packets, check for TRITON host indicators, and validate SIS logic integrity against a known-good backup.
Quick Start
Analyze the attached OT network pcap capture to build a Modbus communication baseline and identify any unauthorized function codes or devices talking to the PLC subnet.
