<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-ics-malware-indicators
description: >-
  Detect indicators of ICS-specific malware including Stuxnet, Industroyer, TRITON,
  Pipedream, and FrostyGoop through network signatures, host artifacts, behavioral
  patterns, and YARA rules tailored for OT environments.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - ics-malware
  - stuxnet
  - industroyer
  - triton
  - pipedream
  - yara
  - threat-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0882", "T0862", "T0857", "T0831"]
  nist-csf: ["DE.CM-4", "DE.CM-7"]
  iec-62443: ["SR 3.2", "SR 3.4"]
  uuid: a1b2c3d4-1010-4000-a010-000000000010
---

# Detecting ICS Malware Indicators

## Overview

ICS-targeted malware families are purpose-built to interact with industrial protocols
and devices. Unlike commodity malware, ICS malware targets specific PLC vendors,
exploits industrial protocols (Modbus, S7comm, OPC-UA, IEC 104), and can manipulate
physical processes. Detection requires ICS-specific signatures, behavioral analysis
of OT network traffic, and host-based indicators on engineering workstations.

Mode: `[MODE: BLUE]` for detection deployment; `[MODE: INCIDENT]` for active threat hunt.

## Prerequisites

| Requirement | Details |
|---|---|
| YARA 4.0+ for file and memory scanning | Required |
| Suricata/Zeek on OT network segments | Required |
| Sysmon on Windows engineering workstations and HMIs | Required |
| Threat intelligence feeds (Dragos WorldView, CISA ICS-CERT) | Required |
| Sandboxed analysis environment for suspicious files | Required |

## Key Concepts

### ICS Malware Family Signatures

```yaml
# Known ICS malware families and indicators
Stuxnet (2010):
  target: Siemens S7-300 PLCs (specific centrifuge config)
  protocols: S7comm
  host_indicators:
    - WinCC database access (s7otbxdx.dll replacement)
    - Step 7 project file infection (.s7p, .mcp)
    - USB propagation via .lnk exploit
  network_indicators:
    - S7comm write to OB1/OB35 blocks
    - Unusual PLC program upload/download frequency

Industroyer/CrashOverride (2016):
  target: Electric grid breakers
  protocols: IEC 104, IEC 61850, OPC-DA
  host_indicators:
    - Custom backdoor (haslo.dat, haslo.exe)
    - Data wiper component
  network_indicators:
    - IEC 104 commands to open breakers
    - Sequential ASDU addressing scan

TRITON/TRISIS (2017):
  target: Schneider Triconex SIS controllers
  protocols: TriStation (UDP/1502)
  host_indicators:
    - trilog.exe masquerading as Triconex log utility
    - inject.bin payload for Triconex firmware
    - Python-compiled executable on engineering workstation
  network_indicators:
    - TriStation protocol traffic from non-engineering host
    - UDP/1502 connections outside maintenance windows

Pipedream/INCONTROLLER (2022):
  target: Omron, Schneider PLCs
  protocols: OPC-UA, Modbus, CODESYS
  host_indicators:
    - Custom tools for OPC-UA browsing and manipulation
    - CODESYS exploitation modules
  network_indicators:
    - OPC-UA browse/write from unexpected sources
    - Modbus FC 16 bulk writes from non-HMI sources
```

### YARA Rules for ICS Malware

```yara
rule TRITON_Inject_Payload {
    meta:
        description = "Detects TRITON/TRISIS injection payload"
        author = "NERF"
        mitre_attack = "T0857"
        severity = "critical"
    strings:
        $tristation = { 01 00 00 00 00 00 }
        $inject_sig = "inject.bin"
        $trilog = "trilog.exe"
        $imain = "script_test.py"
    condition:
        uint16(0) == 0x5A4D and
        (any of ($tristation, $inject_sig, $trilog, $imain))
}

rule ICS_Suspicious_PLC_Interaction {
    meta:
        description = "Detects binaries with ICS protocol library imports"
        author = "NERF"
    strings:
        $snap7 = "snap7" ascii
        $pymodbus = "pymodbus" ascii
        $opcua = "opcua" ascii
        $s7_connect = "Cli_ConnectTo" ascii
        $modbus_write = "write_register" ascii
    condition:
        uint16(0) == 0x5A4D and 3 of them
}
```

### Network-Based Detection

```bash
# Suricata rules for ICS malware network indicators

# Detect TriStation protocol (TRITON indicator)
cat << 'EOF'
alert udp any any -> $ICS_NET 1502 ( \
  msg:"ICS MALWARE - TriStation Protocol Detected (TRITON)"; \
  flow:to_server; \
  content:"|01 00 00 00|"; depth:4; \
  sid:4006001; rev:1; \
  metadata:mitre_attack_technique T0857;)
EOF

# Detect Industroyer IEC 104 ASDU scanning
cat << 'EOF'
alert tcp any any -> $ICS_NET 2404 ( \
  msg:"ICS MALWARE - IEC 104 Sequential ASDU Scan (Industroyer)"; \
  flow:established,to_server; \
  threshold:type both, track by_src, count 50, seconds 10; \
  sid:4006002; rev:1;)
EOF

# Detect suspicious S7comm program modifications
cat << 'EOF'
alert tcp any any -> $ICS_NET 102 ( \
  msg:"ICS MALWARE - S7comm Block Upload from Non-Engineering Host"; \
  flow:established,to_server; \
  content:"|03 00|"; depth:2; \
  content:"|1a|"; offset:17; depth:1; \
  sid:4006003; rev:1; \
  metadata:mitre_attack_technique T0839;)
EOF
```

### Host-Based Detection

```bash
# Scan engineering workstations for ICS malware artifacts
yara -r ics_malware_rules.yar /path/to/scan/

# Check for TRITON artifacts
find /opt /tmp /var -name "trilog*" -o -name "inject.bin" -o -name "*.pyc" 2>/dev/null

# Check for suspicious DLL replacements (Stuxnet-style)
sha256sum /path/to/siemens/s7otbxdx.dll
# Compare against known-good hash

# Sysmon query for suspicious process accessing ICS software
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1} |
  Where-Object { $_.Message -match 'Step 7|TIA Portal|RSLogix|TriStation' }
```

## Workflow

### Step 1: Deploy Detection Signatures

```bash
# Load YARA rules, Suricata ICS rules, Sysmon config
yara -C ics_malware_rules.yar  # Validate syntax
suricata -T -S ics_malware.rules -c /etc/suricata/suricata.yaml
```

### Step 2: Threat Hunt

```bash
# Proactive hunt on OT network and hosts
# Focus: engineering workstations, historian servers, HMIs
yara -r ics_malware_rules.yar C:\ProgramData\ C:\Users\ C:\Temp\
```

### Step 3: Triage Alerts

```bash
# Investigate matches with full malware analysis pipeline
# Preserve evidence, isolate affected system, escalate
```

## Verification

- [ ] YARA rules deployed on engineering workstations and file servers
- [ ] Suricata ICS malware rules active on OT network monitor
- [ ] Known ICS malware artifact paths monitored
- [ ] DLL integrity monitoring on SCADA/HMI software directories
- [ ] Threat intel feeds integrated for new ICS malware IOCs
- [ ] Quarterly threat hunt on OT systems scheduled

## Detection Opportunities

- TriStation protocol from non-engineering workstation → TRITON-style attack
- S7comm block modifications outside change windows → Stuxnet-style injection
- IEC 104 sequential scanning → Industroyer-style reconnaissance
- New binaries with ICS library imports on engineering workstation → attack tooling
- Suspicious DLL in SCADA software directory → supply chain or runtime injection

```yaml
title: Ics Malware Indicators Detection
id: e9b8c524-3882-470b-94c4-67f83d5cf3bb
status: experimental
description: Detects suspicious activity related to detecting ics malware indicators techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*detecting*ics*"
  condition: selection
level: medium
tags:
  - attack.t0882
  - attack.t0862
  - attack.t0857
  - attack.t0831
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- Dragos: ICS Malware Analysis Reports
- MITRE ATT&CK for ICS: Software entries
- CISA ICS-CERT Advisories
- FireEye/Mandiant: TRITON Analysis (2017)
- ESET: Industroyer Technical Analysis (2017)
