Threat Hunting Part 2: Hunting on ICS Networks
Summary: Dragos outlines how ICS threat hunters can use the Purdue Model's five levels - level four business logistics, level three manufacturing operations, level two control systems, level one intelligent devices, and level zero physical process - to divide an industrial network by function for hunting. It notes that level two hunting may be limited to passively tapped network and host data, and that the 2016 Ukraine CRASHOVERRIDE IEC 104 payload ran on Windows and sent only one type of IEC 104 message, making protocol-traffic analysis a useful detection.
Key Takeaway: The article argues that activity between Purdue levels, not just within them, is where attackers show up - citing how domain trust and RDP permitted across a firewall, or SMB traversing levels for historian platforms as with EternalBlue/WannaCry/NotPetya, let stolen credentials pivot through layers of security.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026