Developing and Executing a Fully Informed OT Threat Hunt
Summary: A Dragos blog post, written with former Dragos intelligence technical account manager Michael Gardner, lays out a method for OT threat hunting that starts with an intelligence-driven hypothesis - its example being adversaries exploiting Cisco routers via Jaguar Tooth - and then scopes hunt sources such as Splunk for enterprise data and the Dragos Platform for OT data. The post argues a hunt succeeds by proving or disproving the hypothesis rather than by finding adversary activity, and that a hunt can be a win simply by surfacing gaps, such as 11 routers in one domain found without logging enabled.
What's compelling: The post's own example turns up 11 routers with no logging enabled - meaning any exploitation of those devices would have gone unrecorded, and the hunt's most valuable output was discovering that blind spot rather than catching an attacker.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026