Iran-Linked Hackers Shut Down UK Power Plant for Four Days: OT/ICS Detection and Hardening Guide for Energy Defenders

---
title: Remote Access Tool Execution on OT Zone Windows Hosts
id: 9f2c4b18-3e7a-4d91-b6f5-8a1c2e3d4f5a
status: experimental
description: Detects execution of common commodity remote access tools on Windows hosts in OT/DMZ segments, consistent with Iran-linked intrusions that deploy RMM tooling for persistence on HMI, engineering workstation, or jump host systems.
references:
  - https://attack.mitre.org/techniques/T1219/
  - https://www.securityweek.com/iran-linked-hackers-shut-down-uk-power-plant-for-four-days/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\teamviewer.exe'
      - '\teamviewer_service.exe'
      - '\anydesk.exe'
      - '\screenconnect.exe'
      - '\connectwisecontrol.exe'
      - '\radmin.exe'
      - '\ammyy.exe'
      - '\ngrok.exe'
      - '\chisel.exe'
      - '\rustdesk.exe'
  filter_approved_paths:
    Image|startswith:
      - 'C:\Program Files\ApprovedVendorRemote\'
  condition: selection_image and not 1 of filter_approved_paths
falsepositives:
  - Approved vendor maintenance sessions — maintain an explicit allowlist of RMM tools authorized for OT support and alert on everything else
level: high
---
title: Stop or Disable of SCADA / HMI / Historian Services
id: 4b8d1e62-7c3f-4a25-9d18-2f6b5c8a9e01
status: experimental
description: Detects attempts to stop, disable, or delete services associated with SCADA, HMI, or historian software on Windows hosts — a common precursor to operational disruption and a frequent step before an attacker manipulates or replaces control logic.
references:
  - https://attack.mitre.org/techniques/T1489/
  - https://attack.mitre.org/techniques/T1562/001/
  - https://www.securityweek.com/iran-linked-hackers-shut-down-uk-power-plant-for-four-days/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1489
  - attack.t1562.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    CommandLine|contains:
      - 'sc stop'
      - 'sc config'
      - 'sc delete'
      - 'net stop'
      - 'Stop-Service'
      - 'Set-Service'
      - 'Disable-Service'
  selection_target:
    CommandLine|contains:
      - 'AVEVA'
      - 'Wonderware'
      - 'InTouch'
      - 'Citect'
      - 'ClearSCADA'
      - 'Ignition'
      - 'iFIX'
      - 'Proficy'
      - 'WinCC'
      - 'PCS7'
      - 'FactoryTalk'
      - 'Historian'
      - 'OPC'
      - 'KEPServer'
  condition: all of selection_*
falsepositives:
  - Scheduled maintenance windows — correlate against change tickets; suppress only for approved engineering accounts during defined windows
level: critical
---
title: PLC / Engineering Software Launched by Non-Engineering Process or User Context
id: 7d3e9a41-5b28-4c76-a1f3-6e8d2c4b7f09
status: experimental
description: Detects execution of PLC programming / engineering software (used to read, modify, or download control logic) from unexpected parent processes or user accounts. Unauthorized logic modification is the core objective in disruptive OT intrusions.
references:
  - https://attack.mitre.org/techniques/T0855/
  - https://attack.mitre.org/techniques/T0839/
  - https://www.securityweek.com/iran-linked-hackers-shut-down-uk-power-plant-for-four-days/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.ics
  - attack.t0855
  - attack.t0839
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\tia_portal.exe'
      - '\portal.exe'
      - '\step7.exe'
      - '\unity_pro.exe'
      - '\control_expert.exe'
      - '\rslogix5000.exe'
      - '\studio5000.exe'
      - '\cx-programmer.exe'
      - '\gx_works.exe'
      - '\visilogic.exe'
  selection_suspicious_parent:
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\explorer.exe'
      - '\winword.exe'
      - '\excel.exe'
      - '\rundll32.exe'
      - '\mshta.exe'
  condition: selection_image and selection_suspicious_parent
falsepositives:
  - Rare; engineering tools launched from scripts during automated builds — baseline and allowlist explicitly
level: critical

// Hunt: Unauthorized industrial protocol traffic crossing zones
// Ingest OT firewall / sensor logs into Sentinel via CEF/Syslog (CommonSecurityLog)
// Flag ICS protocol sessions sourced from IT subnets, the internet, or jump hosts outside approved maintenance windows
let ApprovedJumpHosts = dynamic(["10.20.30.11", "10.20.30.12"]); // <-- replace with your approved OT jump host IPs
let ICSPorts = dynamic([502, 102, 20000, 44818, 4840, 789, 1911, 9600]); // Modbus, S7comm, DNP3, EtherNet/IP, OPC UA, Redlion Crimson, Niagara Fox, Omron FINS
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (ICSPorts)
| where not (SourceIP in (ApprovedJumpHosts))
| extend SourceZone = iff(SourceIP startswith "10.40.", "OT_Internal", iff(SourceIP startswith "10.10.", "IT_Corporate", "External_or_Unknown")) // <-- adjust subnets to your architecture
| where SourceZone != "OT_Internal"
| summarize SessionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Destinations = make_set(DestinationIP, 25), Ports = make_set(DestinationPort, 10) by SourceIP, SourceZone, DeviceAction
| order by SessionCount desc;
// Hunt: ICS write/command function codes observed on Modbus from rare sources
// Modbus FC 5/6/15/16 (write coils/registers) and FC 8 diagnostics are the disruptive subset
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort == 502
| where Message has_any ("0x05", "0x06", "0x0F", "0x10", "function code 5", "function code 6", "function code 15", "function code 16", "write_coil", "write_register")
| summarize WriteCmdCount = count(), Targets = make_set(DestinationIP, 25) by SourceIP, bin(TimeGenerated, 1h)
| order by WriteCmdCount desc;
// Hunt: New or unexpected process execution on hosts tagged as OT-adjacent (HMI, EWS, historian)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any ("HMI", "EWS", "ENG-WS", "HIST", "SCADA", "OT-") // <-- align to your naming convention
| where FileName in~ ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "mshta.exe", "bitsadmin.exe", "certutil.exe", "psexec.exe", "anydesk.exe", "teamviewer.exe", "ngrok.exe", "chisel.exe", "rustdesk.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc;

-- Velociraptor hunt: OT DMZ jump host integrity sweep
-- Run against Windows jump hosts, engineering workstations, and HMI servers.
-- Surfaces persistence artifacts, unauthorized RMM tooling, and unexpected network listeners in one pass.

-- Part 1: Unsigned or anomalous processes with outbound command lines
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(anydesk|teamviewer|screenconnect|rustdesk|ngrok|chisel|frpc|plink|-e powershell|encodedcommand|downloadstring|iex)'
   OR Exe =~ '(?i)(appdata|programdata|temp|users\\\\public)\\\\.*\\.exe$'

-- Part 2: Run-key and service persistence referencing non-standard paths
SELECT Name, FullPath AS KeyPath, { SELECT * FROM parse_json(data=to_dict(item=Data)) } AS Values
FROM glob(globs='HKLM/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*',
          accessor='registry')
WHERE Name =~ '(?i)update|service|agent|helper'

-- Part 3: Listening sockets owned by unexpected binaries (catch reverse-shell / RAT listeners)
SELECT Pid, Name, ProcessExe AS Exe, Laddr, Lport, Status
FROM netstat()
WHERE Status =~ 'LISTEN'
  AND Lport in (22, 3389, 5900, 5938, 6568, 4444, 8443, 8080)
  AND NOT ProcessExe =~ '(?i)(svchost|termservice|system32\\\\(sshd|winrm))'

# OT Jump Host / Engineering Workstation Hardening & Verification Script
# Run elevated on Windows hosts in the OT DMZ. Read-only audit + optional -Remediate switch.
# Purpose: verify no unauthorized RMM tooling, no exposed ICS listeners, no rogue admin accounts.
param([switch]$Remediate)

$report = @{ Host = $env:COMPUTERNAME; Time = (Get-Date).ToString('s'); Findings = @() }

# 1) Audit for unauthorized remote access tooling
$ratNames = 'anydesk','teamviewer','screenconnect','rustdesk','ngrok','chisel','frpc','radmin','ammyy'
$procs = Get-Process | Where-Object { $ratNames -contains $_.ProcessName.ToLower() }
if ($procs) {
  $report.Findings += "RMM_RUNNING: $(($procs | Select-Object -Expand ProcessName) -join ',')"
  if ($Remediate) { $procs | Stop-Process -Force }
}
$ratServices = Get-CimInstance Win32_Service | Where-Object {
  $n=$_.Name.ToLower(); $p=($_.PathName ?? '').ToLower();
  ($ratNames | Where-Object { $n -like "*$_*" -or $p -like "*$_*" })
}
if ($ratServices) {
  $report.Findings += "RMM_SERVICE: $(($ratServices | Select-Object -Expand Name) -join ',')"
  if ($Remediate) { $ratServices | ForEach-Object { Stop-Service $_.Name -Force; Set-Service $_.Name -StartupType Disabled } }
}

# 2) Verify no ICS protocol ports listening on Windows hosts (they should live on PLCs, not servers)
$icsPorts = 502,102,20000,44818,4840,789,1911,9600
$listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object { $icsPorts -contains $_.LocalPort }
foreach ($l in $listeners) {
  $own = (Get-Process -Id $l.OwningProcess -ErrorAction SilentlyContinue).ProcessName
  $report.Findings += "ICS_LISTENER: port $($l.LocalPort) owned by $own (PID $($l.OwningProcess))"
}

# 3) Audit local administrators for unauthorized additions
$expected = @('Administrator','DOMAIN\OT-Admins','DOMAIN\SVC-OTMonitoring') # <-- replace with approved list
$actual = Get-LocalGroupMember -Group 'Administrators' -ErrorAction SilentlyContinue | Select-Object -Expand Name
$rogue = $actual | Where-Object { $_ -notin $expected }
if ($rogue) { $report.Findings += "ROGUE_ADMIN: $($rogue -join ',')" }

# 4) Confirm Windows Firewall blocks inbound ICS ports from non-OT subnets
$fw = Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True -ErrorAction SilentlyContinue |
  Get-NetFirewallPortFilter -ErrorAction SilentlyContinue |
  Where-Object { $_.LocalPort -in $icsPorts }
if ($fw) { $report.Findings += "FIREWALL_GAP: inbound allow rule exists on ICS ports — review immediately" }

# 5) Verify LSA/SMB hardening posture relevant to lateral movement into OT
$lsa = (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -ErrorAction SilentlyContinue).RunAsPPL
if ($lsa -ne 1) {
  $report.Findings += 'LSA_PPL_DISABLED'
  if ($Remediate) { Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Lsa' -Name RunAsPPL -Value 1 }
}

$report | ConvertTo-Json -Depth 4
# Baseline this output per host. ANY delta in findings on an OT jump host is an investigation trigger.