detecting-attacks-on-scada-systems

name	detecting-attacks-on-scada-systems
description	This skill covers detecting cyber attacks targeting Supervisory Control and Data Acquisition (SCADA) systems including man-in-the-middle attacks on industrial protocols, unauthorized command injection into PLCs, HMI compromise, historian data manipulation, and denial-of-service against control system communications. It leverages OT-specific intrusion detection systems, industrial protocol anomaly detection, and process data analytics to identify attacks that traditional IT security tools miss.
domain	cybersecurity
subdomain	ot-ics-security
tags	["ot-security","ics","scada","industrial-control","iec62443","intrusion-detection","threat-detection"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"]
mitre_attack	["T0846","T0836","T0831","T0814","T0832"]

Detecting Attacks on SCADA Systems

When to Use

• When deploying intrusion detection capabilities in a SCADA environment for the first time
• When investigating suspected cyber attacks against industrial control systems
• When building detection rules for OT-specific attack patterns (Stuxnet, TRITON, Industroyer)
• When integrating OT network monitoring with an enterprise SOC for unified threat visibility
• When responding to alerts from OT security monitoring tools (Dragos, Nozomi, Claroty)

Do not use for detecting attacks on IT-only networks without SCADA/ICS components, for building generic network IDS rules (see building-detection-rules-with-sigma), or for incident response procedures after an attack is confirmed (see performing-ot-incident-response).

Prerequisites

• Passive network monitoring sensors deployed on SPAN/TAP ports at OT network boundaries
• OT intrusion detection system (Dragos Platform, Nozomi Guardian, Claroty xDome, or Suricata with OT rulesets)
• Understanding of industrial protocols in use (Modbus, DNP3, OPC UA, EtherNet/IP, S7comm)
• Baseline of normal SCADA communication patterns (polling intervals, function codes, register ranges)
• Access to process historian data for physical process anomaly correlation

Workflow

Step 1: Establish SCADA Communication Baselines

Before detecting anomalies, establish what normal SCADA traffic looks like. Industrial protocols are highly deterministic - the same master polls the same slaves at the same intervals reading the same registers.

#!/usr/bin/env python3
"""SCADA Communication Baseline Builder.

Analyzes OT network traffic to establish deterministic baselines for
Modbus/TCP, DNP3, EtherNet/IP, and S7comm communications.
"""

import json
import sys
from collections import defaultdict
from datetime import datetime
from statistics import mean, stdev

try:
    from scapy.all import rdpcap, IP, TCP, UDP
except ImportError:
    print("Install scapy: pip install scapy")
    sys.exit()

MODBUS_FUNC_NAMES = {
    : , : ,
    : , : ,
    : , : ,
    : , : ,
    : , : ,
    : , : ,
    : ,
}


 :
    

     ():
        .modbus_sessions = defaultdict(: {
            : defaultdict(),
            : (),
            : [],
            : ,
            : ,
        })
        .communication_pairs = defaultdict(: {
            : (),
            : ,
            : ,
            : ,
        })

     ():
        
        packets = rdpcap(pcap_file)
        ()

         pkt  packets:
              pkt.haslayer(IP):
                

            src = pkt[IP].src
            dst = pkt[IP].dst
            ts = (pkt.time)

            
            pair_key = 
            pair = .communication_pairs[pair_key]
            pair[] += 
             pair[]  :
                pair[] = ts
            pair[] = ts

            
             pkt.haslayer(TCP)  pkt[TCP].dport == :
                ._analyze_modbus(pkt, src, dst, ts)

     ():
        
        payload = (pkt[TCP].payload)
         (payload) < :
            

        
        func_code = payload[]
        session_key = 
        session = .modbus_sessions[session_key]

        session[][func_code] += 
        session[] += 
        session[] = {}

        
         session[]   :
            interval = timestamp - session[]
              < interval < :  
                session[].append(interval)
        session[] = timestamp

        
         (payload) >=   func_code  (, , , , , , , ):
            start_register = (payload[] << ) | payload[]
             func_code  (, , , , , )  (payload) >= :
                count = (payload[] << ) | payload[]
                session[].add((func_code, start_register, start_register + count))

     ():
        
        baseline = {
            : datetime.now().isoformat(),
            : {},
            : {},
        }

         session_key, session  .modbus_sessions.items():
            avg_interval = mean(session[])  session[]  
            interval_std = stdev(session[])  (session[]) >   

            baseline[][session_key] = {
                : (session[].keys()),
                : {
                    MODBUS_FUNC_NAMES.get(k, ): v
                     k, v  session[].items()
                },
                : (avg_interval, ),
                : (interval_std, ),
                : [
                    {: r[], : r[], : r[]}
                     r  session[]
                ],
                : session[],
            }

         baseline

     ():
        
        baseline = .generate_baseline()
         (output_file, )  f:
            json.dump(baseline, f, indent=)
        ()

        
        ()
        ()
        ()
         session, data  baseline[].items():
            ()
            ()
            ()
            ()
            ()


 __name__ == :
     (sys.argv) < :
        ()
        sys.exit()

    builder = SCADABaselineBuilder()
    builder.process_pcap(sys.argv[])
    output = sys.argv[]  (sys.argv) >   
    builder.export_baseline(output)