Threat Hunting With Python Part 4: Examining Microsoft SQL Based Historian Traffic
Summary: Dragos published the fourth part of its Python threat-hunting series, focused on the Tabular Data Stream (TDS) protocol that carries SQL queries and remote procedure calls to and from Microsoft SQL Server, which backs historians such as GE Proficy/iFix, Honeywell Uniformance PHD, and Schneider Electric Wonderware. Using the pyshark module to filter a packet capture to TDS, the authors tabulated observed queries and nine unique procedure names, noting that industrial environments typically show only select statements while DROP TABLE or CREATE USER would warrant deeper review.
Key Takeaway: A DROP TABLE command against a historian could wipe its data during the action stage of the ICS kill chain, and a CREATE USER statement could add an attacker's account - so knowing which hosts should be issuing which SQL statements is the baseline that makes either visible.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026