<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Auditing ICS Remote Access — API & Tool Reference

> Quick reference for tools, commands, and APIs used in auditing-ics-remote-access.

## Tools

### `nmap`

Remote access discovery

**Usage:**
```bash
nmap -Pn -sT -p 22,3389,5900 10.10.0.0/24
```

**Key Flags:**
  - -p: remote ports
  - --script vnc-info

---

### `hydra`

Default credential testing

**Usage:**
```bash
hydra -L users.txt -P pass.txt target ssh
```

**Key Flags:**
  - -L/-P: lists
  - -M: targets

---

### `teleport-api`

Session audit

**Usage:**
```bash
tctl get sessions
```

**Key Flags:**
  - get sessions
  - get users

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Never execute write operations against production ICS without explicit authorization

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- NIST SP 800-82: Guide to OT Security
