<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting ICS Supply Chain Attacks — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-ics-supply-chain-attacks.

## Tools

### `virustotal`

Malware analysis

**Usage:**
```bash
curl -H 'x-apikey: $K' https://www.virustotal.com/api/v3/files/{h}
```

**Key Flags:**
  - /files/{hash}: reputation
  - /files: upload

---

### `binwalk`

Firmware analysis

**Usage:**
```bash
binwalk -e firmware.bin
```

**Key Flags:**
  - -e: extract
  - -E: entropy

---

### `sigcheck`

Signature verification

**Usage:**
```bash
sigcheck64.exe -c vendor.exe
```

**Key Flags:**
  - -c: CSV
  - Verifies signatures

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Never execute write operations against production ICS without explicit authorization

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- NIST SP 800-82: Guide to OT Security
