Dragos Results of S4 Industrial Cybersecurity Detection Challenge "Contest"
Summary: Dragos took part in the S4x19 ICS Detection Challenge, which used 400 GB of packet captures from a real-world mining operation with adversaries injected by S4 organizers and no baseline, but the contest itself was cancelled for lack of participants and replaced with a revised 130 GB dataset shared with two teams out of a possible 20. Working that dataset, Dragos analyzed 140 network protocols including CIP, OPC, DNP3, ENIP and Modbus, mapped over 4,600 unknown assets, and its Detections Dashboard surfaced 26 threat behaviors, 11 deviations from baseline, 51 configuration changes and 5 indicators, including HAVEX and GREYENERGY behaviors and lateral movement through credential re-use.
What you should know: A challenge designed to test ICS detection vendors drew only two teams out of a possible 20, and the original 8-hour format was replaced by a 5-day window on a reduced dataset - a signal of how thin the bench is for OT threat detection. The 4,600 unknown assets mapped in a single mining operation show how much of the environment most defenders are working without.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026