New Knowledge Pack Released (KP-2023-003)
Summary: Dragos released Knowledge Pack KP-2023-003, containing analysis of 300 vulnerable assets from vendors including Yokogawa, Siemens, Rockwell Automation, Omron, Schneider Electric, Hitachi Energy, WAGO, Phoenix Contact, and Mitsubishi Electric, with over 290 characterizations and 565 detections for customers on Dragos Platform 2.2.1. The pack adds IEC-61850 and GOOSE protocol characterizations for ABB, GE, and SEL devices, Emerson Ovation and ROC identification, DNS tunneling signatures tied to Cobalt Strike BEACON, a detection for CCleaner User-Agent HTTP traffic, and two new dashboards for Threat Detections and Platform Auditing.
Why it matters: The pack ships signatures for DNS tunneling patterns observed with Cobalt Strike BEACON and for CCleaner traffic seen in supply chain attacks - both are techniques that reach into OT networks through infrastructure your IT controls were not built to watch.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026