<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-ics-supply-chain-attacks
description: >-
  Detect and mitigate supply chain compromises targeting ICS/SCADA including
  trojanized vendor software, compromised firmware updates, malicious PLC
  project files, and counterfeit hardware components.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - supply-chain
  - ics
  - scada
  - firmware-integrity
  - vendor-risk
  - ot-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0862", "T0873", "T0839"]
  nist-csf: ["ID.SC-1", "PR.DS-6"]
  iec-62443: ["SR 3.4", "SR 7.7"]
  uuid: a1b2c3d4-1001-4000-a001-000000000010
---

# Detecting ICS Supply Chain Attacks

## Overview

ICS supply chain attacks like PIPEDREAM/INCONTROLLER demonstrate that adversaries
target vendor update mechanisms, engineering software, and hardware supply chains.
Detection requires firmware integrity verification, vendor software validation,
network monitoring for C2 communications, and hardware authenticity checks.

Mode: `[MODE: BLUE]` for monitoring; `[MODE: RED]` for simulation.

## Prerequisites

| Requirement | Details |
|---|---|
| Software Bill of Materials (SBOM) for ICS vendor products | Required |
| Firmware images and checksums from vendor-verified sources | Required |
| Network monitoring on OT segments with egress visibility | Required |
| Sandbox environment for vendor software analysis | Required |
| Hardware inspection tools and vendor serial number databases | Required |
| Threat intelligence feeds covering ICS supply chain | Required |

## Key Concepts

### Vendor Software Verification

```bash
sigcheck64.exe -accepteula -c "TIA_Portal_Update.exe" | grep "Verified"
gpg --verify vendor_update.sig vendor_update.tar.gz
echo "expected_hash  vendor_update.tar.gz" | sha256sum -c -
```

### Firmware Integrity Monitoring

```bash
binwalk -e firmware_update.bin
strings firmware_update.bin | grep -iE "backdoor|shell|wget|curl|/bin/sh"

python3 -c "
import hashlib, json
b = json.load(open('firmware_baseline.json'))
c = hashlib.sha256(open('current_firmware.bin','rb').read()).hexdigest()
print('ALERT: Mismatch!' if c != b['sha256'] else 'OK: Verified')"
```

### C2 Detection on OT Network

```bash
# Unexpected egress
tshark -i eth1 -Y "ip.src == 10.10.0.0/16 && !(ip.dst == 10.0.0.0/8)" \
  -T fields -e ip.src -e ip.dst -e tcp.dstport | sort | uniq -c | sort -rn

# DNS tunneling from OT devices
tshark -i eth1 -Y "dns.qry.name && ip.src == 10.10.0.0/16" \
  -T fields -e ip.src -e dns.qry.name | sort -u

# Beaconing detection
python3 -c "
import json
from collections import defaultdict
by_dst = defaultdict(list)
for c in json.load(open('egress.json')): by_dst[c['dst']].append(c['ts'])
for dst, ts in by_dst.items():
    if len(ts)>10:
        ivs = [ts[i+1]-ts[i] for i in range(len(ts)-1)]
        if (sum((x-sum(ivs)/len(ivs))**2 for x in ivs)/len(ivs))**0.5/max(sum(ivs)/len(ivs),1) < 0.1:
            print(f'BEACON: {dst}')"
```

## Workflow

### Step 1: Scope and Discovery

```bash
python3 detecting_ics_supply_chain_attacks_scope.py --inventory ics_assets.json --output scope.yaml
```

### Step 2: Execute Assessment

```bash
python3 detecting_ics_supply_chain_attacks_execute.py --scope scope.yaml --output results/
```

### Step 3: Analyze and Report

```bash
python3 detecting_ics_supply_chain_attacks_report.py --results results/ --output report.json
```

## Verification

- [ ] SBOM for vendor software
- [ ] Software validated via signatures
- [ ] Firmware baselines with SHA-256
- [ ] OT egress monitoring active
- [ ] Hardware serials verified
- [ ] Sandbox analysis before deployment
- [ ] Post-update monitoring 72+ hours
- [ ] Annual vendor risk assessments

## Detection Opportunities

- Firmware checksum mismatch → compromised update
- Unexpected OT egress → C2 implant
- DNS from PLCs → tunneling
- Invalid vendor signature → trojanized installer
- Regular beaconing → C2 heartbeat

```yaml
title: Ics Supply Chain Attacks Detection
id: 3bb84d37-2370-4811-80d7-3775781f46ee
status: experimental
description: Detects suspicious activity related to detecting ics supply chain attacks techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*detecting*ics*"
  condition: selection
level: medium
tags:
  - attack.t0862
  - attack.t0873
  - attack.t0839
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- CISA: PIPEDREAM/INCONTROLLER
- NIST SP 800-161 Rev 1: SCRM
- IEC 62443-2-4: Service Providers
- SBOM Requirements (NTIA/CISA)
