Defending Water & Wastewater OT Systems Against PLC Targeting - CISA 2026 Alert

---
title: Suspicious OT Protocol Traffic to PLC Subnets
id: c26b5d78-3f4a-4c12-8b56-9e0f1a2b3c4d
status: experimental
description: Detects unusual OT protocol traffic (Modbus, DNP3, Ethernet/IP, Profinet) from non-OT sources to PLC IP ranges. Indicates potential unauthorized PLC access.
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
author: Security Arsenal
date: 2026/07/31
tags:
  - attack.initial_access
  - attack.t1190
  - ics.attack.plc
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    DestinationPort:
      - 502      # Modbus TCP
      - 20000    # DNP3
      - 44818    # Ethernet/IP
      - 102      # Profinet TCP
  selection_not_ot_source:
    SourceIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'  # Modify based on actual OT network segmentation
  condition: selection_ports and selection_not_ot_source
falsepositives:
  - Authorized temporary access from IT network
  - Valid remote engineering access via VPN
level: high
---
title: PLC Engineering Software Spawning System Commands
id: e74c8e91-2d5f-4a6b-9e23-0f4a1b2c3d4e
status: experimental
description: Detects PLC engineering software (RSLogix, Unity Pro, TIA Portal) spawning suspicious system commands. Common technique for post-exploitation on OT engineering workstations.
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
author: Security Arsenal
date: 2026/07/31
tags:
  - attack.execution
  - attack.t1059
  - ics.attack.engineering_workstation
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'RSLogix'
      - 'Studio 5000'
      - 'Unity Pro'
      - 'TIA Portal'
      - 'GX Works'
      - 'Connected Components Workbench'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate automation scripts executed by engineers
  - Software update processes
level: medium
---
title: HMI Tag Database Modification Outside Maintenance Window
id: f85d9f02-3e6a-4b7c-8f34-1a5b2c3d4e5f
status: experimental
description: Detects modifications to HMI/SCADA tag database files outside defined maintenance windows. Tag database tampering is a common persistence mechanism in PLC targeting attacks.
references:
  - https://www.cisa.gov/news-events/alerts/2026/07/30/cisa-urges-water-and-wastewater-systems-sector-protect-ot-against-activity-targeting-plcs
author: Security Arsenal
date: 2026/07/31
tags:
  - attack.persistence
  - attack.t1055
  - ics.attack.hmi
logsource:
  category: file_change
  product: windows
detection:
  selection_files:
    TargetFilename|contains:
      - '.db'
      - '.tags'
      - '.tag'
      - '.csv'  # Common tag export format
    TargetFilename|contains:
      - 'HMI'
      - 'SCADA'
      - 'Ignition'
      - 'WinCC'
      - 'FactoryTalk'
  selection_time:
    TimeGenerated between(2026-01-01T00:00:00 .. 2026-12-31T23:59:59)  # Adjust to non-maintenance hours
  condition: selection_files and selection_time
falsepositives:
  - Authorized tag database changes during maintenance
  - Automated tag synchronization
level: high

// Hunt for suspicious OT protocol traffic to PLC assets
let OTProtocolPorts = dynamic([502, 102, 44818, 20000, 34964, 34965, 34966, 34967, 34968]);
let NonWorkHours = bin(datetime(2026-01-01T18:00:00), 1h) .. bin(datetime(2026-01-02T06:00:00), 1h); // Adjust to actual non-business hours
let PLCAssetIps = dynamic(["10.20.30.0/24", "192.168.100.0/24"]); // Update with actual PLC subnet ranges
DeviceNetworkEvents
| where DestinationPort in (OTProtocolPorts)
| where ipv4_is_in_range(DestinationIP, "10.20.30.0/24") or ipv4_is_in_range(DestinationIP, "192.168.100.0/24") // Check against PLC IP ranges
| where not(ipv4_is_in_range(SourceIP, "10.20.30.0/24")) // Traffic originating outside OT network
| where Timestamp between(datetime(2026-07-01) .. now())
| summarize count() by bin(Timestamp, 1h), SourceIP, DestinationIP, DestinationPort, InitiatingProcessFileName
| order by count_ desc
| extend AlertDetail = strcat("Suspicious OT protocol traffic from ", SourceIP, " to PLC at ", DestinationIP, " on port ", tostring(DestinationPort))

// Query for failed authentication attempts to OT systems
SecurityEvent
| where TimeGenerated between(datetime(2026-07-01) .. now())
| where EventID == 4625 // Failed logon
| where TargetUserName has_any ("admin", "engineer", "scada", "plc", "hmi") or ComputerName has_any ("HMI", "SCADA", "PLC", "OT")
| project TimeGenerated, ComputerName, TargetUserName, IpAddress, LogonType, Status
| summarize FailedLogons = count() by bin(TimeGenerated, 1h), ComputerName, IpAddress, TargetUserName
| where FailedLogons > 5 // Threshold tuning required
| order by FailedLogons desc

// Hunt for unexpected PLC write operations via OT firewall logs
CommonSecurityLog
| where DeviceVendor in ("Palo Alto", "Fortinet", "Cisco") // Adjust for actual OT firewall vendors
| where ApplicationProtocol in ("modbus", "dnp3", "c-ip", "profinet")
| where RequestAction == "Block" or RequestAction == "Deny"
| where TimeGenerated between(datetime(2026-07-01) .. now())
| parse Message with * "function code" FunctionCode: string "*"
| where FunctionCode contains_any ("5", "6", "15", "16") // Modbus write function codes
| summarize BlockedWrites = count() by bin(TimeGenerated, 1h), SourceIP, DestinationIP, ApplicationProtocol, FunctionCode
| order by BlockedWrites desc

-- Hunt for PLC engineering workstation processes with suspicious network connections
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'RSLogix' OR Name =~ 'Studio 5000' OR Name =~ 'Unity Pro' OR Name =~ 'TIA Portal' OR Name =~ 'GX Works'

-- Cross-reference with network connections to PLC IP ranges
LET PIDS = SELECT Pid FROM pslist() WHERE Name =~ 'RSLogix' OR Name =~ 'Studio 5000' OR Name =~ 'Unity Pro' OR Name =~ 'TIA Portal' OR Name =~ 'GX Works'
SELECT Pid, RemoteAddr, RemotePort, State, Family
FROM netstat()
WHERE Pid in (SELECT Pid FROM PIDS)
  AND (RemotePort = 502 OR RemotePort = 44818 OR RemotePort = 20000 OR RemotePort = 102)

-- Hunt for modified HMI/SCADA project files in last 7 days
SELECT FullPath, Size, Mode.ModTime, Mode.Uid, Mode.Gid, Data
FROM glob(globs="/var/scada/**/*.prj", accessor="auto")
WHERE ModTime > now() - 7 * 86400

-- Search for persistence mechanisms in OT engineering workstations
SELECT Name, Path, Hive, Key, Modified, Data.type
FROM registry_glob(globs="HKLM\Software\Microsoft\Windows\CurrentVersion\Run\*\*")
WHERE Data.value =~ 'PLC' OR Data.value =~ 'SCADA' OR Data.value =~ 'HMI'

-- Identify recently downloaded files that could be PLC project files
SELECT FullPath, Size, Mode.ModTime
FROM glob(globs="/home/*/Downloads/*.{prj,apx,pro,mer}", accessor="auto")
WHERE ModTime > now() - 3 * 86400

#!/bin/bash
# PLC Hardening and Security Assessment Script for Water/Wastewater OT Environments
# Version: 1.0
# Date: 2026-07-31
# Purpose: Assess and harden PLC configurations against CISA-identified threats

# Variables - Update these values based on your environment
PLC_SUBNET="10.20.30.0/24"
ENGINEERING_WORKSTATIONS="192.168.50.10,192.168.50.11"
MAINTENANCE_WINDOW_START="02:00"
MAINTENANCE_WINDOW_END="04:00"
LOG_FILE="/var/log/ot-security/plc_hardening_$(date +%Y%m%d_%H%M%S).log"

# Logging function
log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

log "Starting PLC Security Assessment and Hardening"
log "================================================"

# Check if running as root
if [[ $EUID -ne 0 ]]; then
   log "ERROR: This script must be run as root"
   exit 1
fi

# Function to check OT network segmentation
check_segmentation() {
    log "Checking OT network segmentation..."
    
    # Verify firewall rules block non-OT traffic to PLC subnet
    iptables -L INPUT -v -n | grep -q "$PLC_SUBNET"
    if [ $? -eq 0 ]; then
        log "[INFO] Existing firewall rules detected for PLC subnet"
    else
        log "[WARNING] No explicit firewall rules for PLC subnet found"
        log "[ACTION] Recommend implementing: iptables -A INPUT -s ! $ENGINEERING_WORKSTATIONS -d $PLC_SUBNET -j DROP"
    fi
}

# Function to audit PLC authentication settings
audit_plc_auth() {
    log "Auditing PLC authentication configurations..."
    
    # Check for default credentials in PLC access configurations
    DEFAULT_CREDS_PATTERNS=("admin/admin" "admin/password" "admin/" "administrator/")
    for pattern in "${DEFAULT_CREDS_PATTERNS[@]}"; do
        grep -r "$pattern" /etc/plc-access/ 2>/dev/null
        if [ $? -eq 0 ]; then
            log "[CRITICAL] Default credentials pattern found: $pattern"
        fi
    done
}

# Function to verify PLC write protection
verify_write_protection() {
    log "Verifying PLC write protection mechanisms..."
    
    # Check if PLC write operations are restricted to maintenance windows
    if command -v plc-config &> /dev/null; then
        plc-config --get-write-protection &>> "$LOG_FILE"
        log "[INFO] Current PLC write protection settings logged"
    else
        log "[WARNING] PLC configuration tool not available - manual verification required"
    fi
}

# Function to audit HMI tag databases
audit_hmi_tags() {
    log "Auditing HMI tag database integrity..."
    
    # Find recently modified tag database files
    find /var/scada/hmi/tags -name "*.db" -o -name "*.tag" -o -name "*.tags" -mtime -7 2>/dev/null | while read file; do
        log "[INFO] Recently modified tag file: $file"
        # Get file checksum for comparison
        md5sum "$file" >> "$LOG_FILE"
    done
}

# Function to check for unauthorized OT protocol traffic
check_ot_traffic() {
    log "Checking for unauthorized OT protocol traffic..."
    
    # Monitor for traffic on OT ports from non-authorized sources
    OT_PORTS="502,102,44818,20000,34964-34968"
    tcpdump -i any -nn "tcp port {$OT_PORTS} and not src host $ENGINEERING_WORKSTATIONS" -c 5 -w /tmp/ot_traffic_capture.pcap 2>/dev/null &
    TCPDUMP_PID=$!
    sleep 10
    kill $TCPDUMP_PID 2>/dev/null
    
    if [ -s /tmp/ot_traffic_capture.pcap ]; then
        log "[WARNING] Captured unauthorized OT protocol traffic"
        tcpdump -r /tmp/ot_traffic_capture.pcap -nn | head -20 | tee -a "$LOG_FILE"
    else
        log "[INFO] No unauthorized OT traffic detected during scan"
    fi
}

# Function to verify PLC firmware versions
verify_firmware() {
    log "Verifying PLC firmware versions against vendor advisories..."
    
    # This would need to be customized for your specific PLC vendor
    # Example structure for checking firmware versions
    if [ -f /etc/plc-inventory/firmware_versions ]; then
        log "[INFO] PLC firmware inventory file found"
        cat /etc/plc-inventory/firmware_versions | tee -a "$LOG_FILE"
    else
        log "[WARNING] PLC firmware inventory not found - manual verification required"
    fi
}

# Execute all checks
check_segmentation
audit_plc_auth
verify_write_protection
audit_hmi_tags
check_ot_traffic
verify_firmware

log "================================================"
log "PLC Security Assessment Complete"
log "Review log file: $LOG_FILE"

exit 0