<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-ics-insider-threats
description: >-
  Detect and investigate insider threat indicators in ICS/SCADA environments
  including unauthorized access patterns, privilege abuse, process manipulation,
  and data exfiltration using behavioral analytics and OT-specific monitoring.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - insider-threat
  - ics
  - scada
  - behavioral-analytics
  - access-control
  - ot-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0826", "T0831", "T0882"]
  nist-csf: ["DE.CM-3", "PR.AC-4"]
  iec-62443: ["SR 1.1", "SR 2.1"]
  uuid: a1b2c3d4-1001-4000-a001-000000000007
---

# Detecting ICS Insider Threats

## Overview

Insider threats in ICS carry disproportionate risk because operators have
legitimate access to safety-critical systems. A disgruntled engineer can modify
PLC logic, disable safety interlocks, or exfiltrate proprietary process recipes.
Detection requires correlating IT access, OT traffic, physical access, and
process data anomalies.

Mode: `[MODE: BLUE]` for monitoring; `[MODE: INCIDENT]` for active investigation.

## Prerequisites

| Requirement | Details |
|---|---|
| Centralized log collection from IT and OT systems (SIEM) | Required |
| Network monitoring on engineering workstation segments | Required |
| Physical access control system (PACS) logs integration | Required |
| User and Entity Behavior Analytics (UEBA) platform | Required |
| PLC program change detection capability | Required |
| Process historian data for anomaly detection | Required |

## Key Concepts

### Behavioral Indicators

```yaml
access_anomalies:
  - After-hours engineering workstation access
  - Accessing PLCs outside assigned zone
  - Multiple failed auth followed by success
programming_anomalies:
  - PLC downloads without change ticket
  - Safety interlock modifications
  - Setpoint changes outside normal range
data_exfiltration:
  - Large transfers from historian to USB
  - Program export to removable media
```

### Log Correlation

```bash
# Splunk — after-hours EWS login
index=ot_auth EventCode=4624 | where date_hour < 6 OR date_hour > 18
  | where dest IN ("EWS-01","EWS-02") | stats count by user, dest

# Badge/session correlation
python3 -c "
import json
for s in json.load(open('active_sessions.json')):
    for b in json.load(open('badge_exits.json')):
        if s['user']==b['user'] and s['login_time']>b['exit_time']:
            print(f'ALERT: {s[\"user\"]} session after badge-out')"

# USB detection (Windows Event 6416)
wevtutil qe Security "/q:*[System[(EventID=6416)]]" /f:text /c:50
```

### Network Behavioral Analysis

```bash
tshark -i eth1 -f "host 10.10.1.50" -a duration:86400 -w ews_baseline.pcap
tshark -r ews_baseline.pcap -T fields -e ip.dst -e tcp.dstport | sort | uniq -c > baseline.txt
# Compare: diff baseline.txt current.txt
```

## Workflow

### Step 1: Scope and Discovery

```bash
python3 detecting_ics_insider_threats_scope.py --inventory ics_assets.json --output scope.yaml
```

### Step 2: Execute Assessment

```bash
python3 detecting_ics_insider_threats_execute.py --scope scope.yaml --output results/
```

### Step 3: Analyze and Report

```bash
python3 detecting_ics_insider_threats_report.py --results results/ --output report.json
```

## Verification

- [ ] Behavioral baselines for OT users
- [ ] SIEM correlation rules deployed
- [ ] Physical access logs integrated
- [ ] PLC change detection active
- [ ] After-hours alerts configured
- [ ] USB detection enabled
- [ ] Historian anomaly detection running
- [ ] Investigation playbook tested

## Detection Opportunities

- After-hours EWS access → suspicious
- Programming from non-designated EWS → compromise
- Badge-out with active session → credential sharing
- Setpoint changes outside range → manipulation
- Large transfers to removable media → exfiltration

```yaml
title: Ics Insider Threats Detection
id: 2efbf433-7551-4913-ae02-e0264996742d
status: experimental
description: Detects suspicious activity related to detecting ics insider threats techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*detecting*ics*"
  condition: selection
level: medium
tags:
  - attack.t0826
  - attack.t0831
  - attack.t0882
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- CISA Insider Threat Mitigation Guide
- NIST SP 800-82 Rev 3
- IEC 62443-2-1: Personnel Security
- Carnegie Mellon CERT Insider Threat Center
