<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting ICS Malware Indicators — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-ics-malware-indicators.

## Tools

### `yara`

Pattern matching tool for ICS malware detection on files and memory.

**Usage:**
```bash
yara -r <rules.yar> <scan_path>
```

**Key Flags:**
  - `-r`: recursive directory scan
  - `-s`: print matching strings
  - `-C`: validate rule syntax
  - `-p <threads>`: parallel scanning

---

### `suricata`

Network IDS with ICS malware signature detection.

**Usage:**
```bash
suricata -r <pcap> -S ics_malware.rules -l /tmp/output/
```

**Key Protocols:**
  - Modbus (TCP/502)
  - S7comm (TCP/102)
  - DNP3 (TCP/20000)
  - IEC 104 (TCP/2404)

---

### `tshark`

Protocol-specific IOC detection in network captures.

**Usage:**
```bash
tshark -r <pcap> -Y "udp.port == 1502"
```

**Key Filters:**
  - `udp.port == 1502`: TriStation (TRITON indicator)
  - `tcp.port == 2404`: IEC 104 (Industroyer indicator)

---

### `strings`

Extract readable strings from firmware and binary files.

**Usage:**
```bash
strings -n 8 <binary> | grep -iE "version|password|key"
```

---

## Integration Notes

- YARA rules should be updated with latest ICS malware IOCs from CISA/Dragos
- Network signatures detect protocol-level indicators even for unknown variants
- Combine host and network indicators for higher-confidence detection
- Preserve all matches for forensic analysis before remediation

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- MITRE ATT&CK for ICS: Software entries
