ics-overview

# ICS / OT Operator Skill Catalog Industrial engagements are not application security with longer rules of engagement — they are a different discipline. A miswritten Modbus coil on a real plant kills people. This catalog is **read-mostly by default**; every write-scope skill carries an explicit safety gate. ## Hard rules 1. **No writes without OPPLAN.safety_critical confirmation**. The middleware refuses writes when the active OPPLAN objective does not carry `safety_critical_confirmed=true`. Bypass requires operator signature in `/workspace/safety-attestation.txt`. 2. **Read-only protocol discovery first**. Identify what's on the wire before any active probing. Many ICS protocols are unauthenticated; a single malformed read can crash an old PLC. 3. **Out-of-band physical safety**. The blue team includes plant ops. A ConOps with `blue_team.plant_ops_phone` is mandatory for engagements on active production lines. ## Playbooks > **Inline technique reference — not separately loadable skills.** The entries below > are summarized here for direct use; there is no separate `SKILL.md` to open for > each. Do NOT call the skill loader on them — apply the technique with your tools > using this summary and the Workflow in this file. | Technique | Use for | |---|---| | **modbus-discovery** | Read-only Modbus TCP/RTU enumeration, function code 3/4 polling | | **modbus-write** | **GATED** Write coils / registers; safety gate enforced | | **bacnet-discovery** | BACnet/IP Who-Is, object enumeration, device profile | | **s7comm** | Siemens S7 / S7Comm Plus enumeration via Snap7 / python-snap7 | | **dnp3** | DNP3 outstation / master discovery; integrity poll | | **opcua** | OPC-UA browse, anonymous auth check, certificate analysis | | **hmi-web** | HMI web stacks (Wonderware, Iconics, Schneider) — known CVEs | | **engineering-software** | TIA Portal / Studio 5000 / Unity Pro project extraction | ## Workflow 1. **Passive observation**: tap a SPAN port if available. Identify protocols on the wire (`tshark -Y modbus || tshark -Y bacnet || ...`). 2. **Network-layer discovery**: nmap with `-sV --script modbus-discover`, `bacnet-info`, `s7-info`, `dnp3-info` (NSE scripts ship in Kali by default; some are slow — set `-T2` for production networks). 3. **Function-code-3 polling**: read holding registers from every Modbus device discovered. Log register maps to the knowledge graph as `:Service` nodes with `protocol=modbus`. 4. **Identify the safety integrity level (SIL)** of any device touched. SIL 3+ devices NEVER get write probes without plant-ops sign-off. 5. **Engineering software attack path**: if you can reach the engineering workstation, extract the project archive (.s7p, .acd, .stp). The project file is the crown jewel — it reveals the entire process model. ## Detection gap ICS networks rarely have host-based detection on PLCs/RTUs themselves — the detection stack lives on the engineering workstation, the historian, and any IT/OT gateway. Detector agent should generate Sigma rules targeting: - Function-code anomalies (write to coils outside normal ranges). - Connection sources outside the documented MES/SCADA IP set. - TIA Portal / Studio 5000 project download events. ## Out of scope by default Active glitching of PLC firmware; firmware upload to PLCs; safety controller writes — all of these require an explicit RoE annex signed by the asset owner. The default ICS RoE template in `soundwave/` includes this annex skeleton.