<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-ics-wireless-communications
description: >-
  Audit and secure wireless communications in ICS/SCADA environments including
  industrial Wi-Fi, WirelessHART, ISA100.11a, Zigbee, cellular gateways, and
  rogue access points within OT facility perimeters.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - wireless
  - ics
  - scada
  - wifi
  - wirelesshart
  - rogue-ap
  - ot-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0860", "T0883", "T0886"]
  nist-csf: ["PR.AC-5", "DE.CM-1"]
  iec-62443: ["SR 3.1", "SR 5.2"]
  uuid: a1b2c3d4-1001-4000-a001-000000000011
---

# Auditing ICS Wireless Communications

## Overview

Wireless communications in ICS introduce attack surfaces invisible to traditional
network monitoring. Industrial Wi-Fi, WirelessHART sensor networks, cellular
failover gateways, and rogue access points can provide OT network entry. Auditing
requires RF spectrum analysis, protocol-specific tools, and physical site surveys.

Mode: `[MODE: RED]` for wireless pentesting; `[MODE: BLUE]` for audit.

## Prerequisites

| Requirement | Details |
|---|---|
| Wireless adapter supporting monitor mode (Alfa AWUS036ACH) | Required |
| Spectrum analyzer (Wi-Spy, RF Explorer) for ISM band analysis | Required |
| Aircrack-ng suite for Wi-Fi auditing | Required |
| Kismet for wireless device discovery | Required |
| Physical access to facility for site survey | Required |
| Authorization for wireless penetration testing | Required |

## Key Concepts

### Wireless Discovery

```bash
airmon-ng start wlan0
airodump-ng wlan0mon --band abg -w ot_wireless --output-format csv,pcap

# Detect rogue APs
python3 -c "
import csv, json
auth = {a['bssid'].upper() for a in json.load(open('authorized_aps.json'))}
with open('ot_wireless-01.csv') as f:
    for r in csv.reader(f):
        if len(r)>5 and ':' in r[0] and r[0].strip().upper() not in auth:
            print(f'ROGUE: {r[0].strip()} SSID={r[13].strip() if len(r)>13 else \"\"}')"
```

### Wi-Fi Security Assessment

```bash
airodump-ng wlan0mon --bssid AA:BB:CC:DD:EE:FF -c 6 -w capture
eaphammer --bssid AA:BB:CC:DD:EE:FF --essid "OT-WiFi" --interface wlan0mon
wash -i wlan0mon | grep -v "Locked"  # Check WPS
nmap -Pn -sT -p 502,102,44818 10.10.0.0/24 --max-rate 5  # Verify isolation
```

### Industrial Wireless Audit

```bash
zbstumbler -c 11-26  # Zigbee scanning
zbdump -c 15 -w zigbee.pcap
hcitool lescan | grep -i "sensor\|industrial"  # BLE
nmap -Pn -sT -p 80,443,22 -sV cellular_gw_ip  # Cellular gateway
```

## Workflow

### Step 1: Scope and Discovery

```bash
python3 auditing_ics_wireless_communications_scope.py --inventory ics_assets.json --output scope.yaml
```

### Step 2: Execute Assessment

```bash
python3 auditing_ics_wireless_communications_execute.py --scope scope.yaml --output results/
```

### Step 3: Analyze and Report

```bash
python3 auditing_ics_wireless_communications_report.py --results results/ --output report.json
```

## Verification

- [ ] Complete site survey
- [ ] APs classified (authorized/rogue)
- [ ] Rogue APs removed
- [ ] WPA3/WPA2-Enterprise enforced
- [ ] Wi-Fi isolated from OT VLANs
- [ ] Industrial wireless encryption verified
- [ ] Cellular gateways secured
- [ ] Spectrum analysis completed

## Detection Opportunities

- New BSSID → rogue AP
- Deauth frames → wireless attack
- Unexpected Zigbee → unauthorized sensors
- Cellular spikes → exfiltration
- RF interference → jamming

```yaml
title: Auditing Ics Wireless Communications Detection
id: 833c71af-6559-4893-90cb-f52eac8f9f74
status: experimental
description: Detects suspicious activity related to auditing ics wireless communications techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*auditing*ics*"
  condition: selection
level: medium
tags:
  - attack.t0860
  - attack.t0883
  - attack.t0886
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- NIST SP 800-82 Rev 3 — Wireless
- IEC 62443-3-3 SR 3.1
- ISA-100.11a: Wireless for Industrial
- WirelessHART (IEC 62591)
