Nation-State and AI-Driven Threats to Critical Infrastructure: A Defender's Guide to IT/OT Asset Visibility and Hardening

Tenable's latest Cybersecurity Awareness Month analysis lands on a conclusion that those of us running IR engagements in industrial environments have been warning about for years: critical infrastructure organizations are being targeted by nation-state groups at a tempo and sophistication level that outpaces their ability to even see their own attack surface.

The core finding isn't a single CVE or a novel exploit. It's something more fundamental — and more dangerous:

1. Asset visibility gaps are creating hidden vulnerability pathways. Legacy OT systems — PLCs, HMIs, RTUs, historians — were deployed decades ago, often without agents, APIs, or even accurate documentation. They sit unmonitored, unpatched, and frequently unknown to the security team.
2. AI is collapsing the reconnaissance timeline. Attackers are using AI tooling to map converged IT/OT networks at machine speed, specifically hunting for uninventoried legacy systems as initial access and pivot points.
3. AI is democratizing specialized ICS knowledge. Breaching an industrial control environment used to require rare, hard-won expertise in protocols like Modbus, DNP3, and S7comm. AI-assisted research is shortening that learning curve dramatically, meaning more threat actors can credibly target OT.

CISA and partner agencies are actively advising critical infrastructure operators on defending essential services — and their guidance consistently starts where this problem starts: you cannot defend what you cannot see.

This post breaks down the defensive implications and gives your SOC concrete detection content for the reconnaissance and pivot behaviors that precede an OT intrusion.

Why This Matters Now

In the incidents I've worked involving industrial environments — energy, water, manufacturing — the pattern repeats: the adversary rarely starts in OT. They start in IT, enumerate relentlessly, find the forgotten engineering workstation or the undocumented jump host bridging the DMZ, and then pivot. What has changed in 2025–2026 is the speed and scale of the enumeration phase. AI-assisted tooling lets an operator process network topology, vulnerability data, and ICS protocol documentation faster than a human red team ever could. Reconnaissance that took weeks now takes hours.

The corollary for defenders: if your detection strategy assumes a slow, noisy adversary, you will miss this. Your detection window has compressed, and the burden shifts to continuous asset discovery and behavioral detection on the IT/OT boundary.

Technical Analysis: The Attack Chain Through an Unmanaged OT Estate

The Visibility Gap as the Initial Condition

Older OT systems resist traditional inventory methods for structural reasons:

• No agents. You can't install an EDR sensor on a 20-year-old PLC running proprietary firmware.
• Fragile networks. Active scanning that works fine on IT subnets can crash legacy ICS devices — a real operational risk that makes teams afraid to scan at all.
• Protocol opacity. OT protocols (Modbus/TCP 502, DNP3 over 20000, S7comm over 102, EtherNet/IP over 44818) were designed without authentication or encryption and are invisible to standard IT monitoring tools.
• Organizational split. OT often reports to operations or engineering, not IT security — so assets literally fall outside the security team's remit.

The result: shadow OT. Devices reachable from the corporate network that nobody in security knows exist.

How Nation-State Actors Exploit the Gap

The attack chain we see in OT-targeting intrusions maps closely to MITRE ATT&CK for ICS:

1. Initial Access (IT side): Phishing, internet-facing service exploitation, or compromised credentials against VPN/remote access infrastructure.
2. Discovery (T0846 – Remote System Discovery, T0840 – Network Connection Enumeration): Systematic enumeration of the converged network. This is where AI-assisted tooling shines — rapidly identifying dual-homed hosts, engineering workstations, and protocol-speaking devices. Expect heavy use of net view, nltest, ARP cache inspection, and targeted connection attempts to ICS ports.
3. Collection (T0888 – Theft of Operational Information): Harvesting engineering diagrams, HMI configurations, historian exports, and network drawings — the reconnaissance payload that enables later disruption.
4. Pivot and Persistence (T0867 – Lateral Tool Transfer, T0859 – Valid Accounts): Moving through the OT DMZ via legitimate engineering pathways — jump servers, remote access for vendors, dual-homed historian servers.
5. Impact preparation: Establishing quiet, durable access to safety-relevant systems for later activation.

The critical defensive insight: stages 2–4 are detectable with the telemetry you already have, if you're looking. ICS protocol traffic from non-engineering endpoints, discovery command storms on boundary hosts, and lateral movement into OT DMZ assets are all high-fidelity signals.

Exploitation Status

This is not a theoretical discussion. CISA's joint advisories throughout 2025 and into 2026 have documented nation-state pre-positioning in US critical infrastructure — actors maintaining access for years inside IT networks of water, energy, and transportation operators, expressly to enable future OT disruption. The Tenable piece reinforces what CISA's guidance assumes as ground truth: the adversary is already mapping you. The question is whether your asset inventory is better than theirs.

Detection & Response

The detections below target the reconnaissance and pivot phase — the highest-value intervention point. They are tuned for the IT/OT boundary: discovery behavior on boundary assets and ICS protocol connections originating outside the engineering zone. Tune the allowlists to your environment before deploying.

Sigma Rules

---
title: Network Discovery Command Cluster on Potential OT Boundary Hosts
id: 3f8a2c91-7b4e-4d12-9a56-2e1c8f04b7d3
status: experimental
description: Detects clusters of network discovery commands (net view, nltest, qwinsta) commonly executed during adversary enumeration of converged IT/OT networks. Nation-state actors performing AI-assisted reconnaissance at machine speed tend to fire multiple discovery commands in rapid succession on pivot hosts.
references:
  - https://attack.mitre.org/techniques/T0846/
  - https://www.tenable.com/blog/critical-infrastructure-orgs-face-heightened-cyber-risk-from-nation-state-groups-ai-threats
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t0846
  - attack.t1087
  - attack.t1018
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\net.exe'
      - '\net1.exe'
      - '\nltest.exe'
      - '\qwinsta.exe'
      - '\arp.exe'
      - '\ipconfig.exe'
  selection_cli:
    CommandLine|contains:
      - ' view'
      - ' /domain'
      - 'dclist'
      - ' /all'
      - ' -a'
  condition: selection_img and selection_cli
falsepositives:
  - System administrators performing legitimate inventory
  - IT asset management software with discovery agents — allowlist known service accounts and paths
level: medium
---
title: Connection to ICS/OT Protocol Ports from Non-Engineering Endpoint
id: 9c1e5b47-2f8d-4a63-b891-5d7f0a3c2e19
status: experimental
description: Detects outbound network connections to common industrial control system protocol ports (Modbus 502, S7comm 102, DNP3 20000, EtherNet/IP 44818, BACnet 47808) from processes not associated with engineering software. Legitimate ICS traffic should originate only from HMIs, engineering workstations, and SCADA servers — any other source is a strong pivot indicator.
references:
  - https://attack.mitre.org/techniques/T0846/
  - https://attack.mitre.org/techniques/T0885/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.discovery
  - attack.t0846
  - attack.t0885
logsource:
  category: network_connection
  product: windows
detection:
  selection_port:
    DestinationPort:
      - 102
      - 502
      - 20000
      - 44818
      - 47808
  filter_engineering:
    Image|endswith:
      - '\RSLinxNG.exe'
      - '\Studio5000.exe'
      - '\TIAPortal.exe'
      - '\MatrikonOPCExplorer.exe'
  filter_host_type:
    Image|startswith:
      - 'C:\Program Files (x86)\Rockwell'
      - 'C:\Program Files\Siemens'
  condition: selection_port and not 1 of filter_*
falsepositives:
  - OT vulnerability scanners (Tenable.ot, Claroty, Dragos sensors) — allowlist scanner host IPs
  - Legitimate vendor remote support sessions — correlate with approved change windows
level: high
---
title: Suspicious Utility Execution from Engineering or OT DMZ Host Naming Convention
id: 5d4a7f02-1c96-4e28-a473-8b2e9d15f6a0
status: experimental
description: Detects execution of common post-exploitation or living-off-the-land binaries on hosts following typical OT/engineering naming conventions (ENG, HMI, OT, SCADA, DMZ prefixes). Adjust the ComputerName pattern to match your organization's OT asset naming scheme.
references:
  - https://attack.mitre.org/techniques/T0867/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.lateral_movement
  - attack.t0867
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_host:
    ComputerName|startswith:
      - 'ENG-'
      - 'HMI-'
      - 'OT-'
      - 'SCADA-'
      - 'OTDMZ-'
  selection_img:
    Image|endswith:
      - '\psexec.exe'
      - '\psexesvc.exe'
      - '\wmic.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
  condition: all of selection_*
falsepositives:
  - Engineering maintenance using PsExec for PLC software deployment — restrict to approved admin accounts
  - HMI software updaters using rundll32 — baseline per-host and alert on deviations
level: high

KQL — Microsoft Sentinel / Defender

This query hunts for connections to ICS protocol destination ports from devices not on your approved engineering asset list. Maintain the engineering device list as a watchlist (EngineeringAssets) in production; the inline dynamic list below is a starting scaffold.

// Hunt: Non-engineering devices initiating connections to ICS/OT protocol ports
// Tune: replace the inline device list with a Sentinel watchlist of approved
// engineering workstations, HMIs, SCADA servers, and OT scanners.
let ICSPorts = dynamic([102, 502, 20000, 44818, 47808]);
let ApprovedOTSources = dynamic(["ENG-WS-01", "HMI-PLANT-A", "OT-SCANNER-01"]);
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where RemotePort in (ICSPorts)
| where DeviceName !in~ (ApprovedOTSources)
| where ActionType == "ConnectionSuccess"
| summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    ConnectionCount = count(),
    Ports = make_set(RemotePort),
    Destinations = make_set(RemoteIP),
    Processes = make_set(InitiatingProcessFileName),
    Accounts = make_set(InitiatingProcessAccountName)
  by DeviceName, DeviceId
| extend ProcessAnomaly = iff(array_length(Processes) > 3, "Multi-process scanning pattern", "Single process")
| order by ConnectionCount desc;

For environments ingesting firewall or OT sensor telemetry via syslog/CEF into Sentinel, this companion query catches ICS protocol talkers flagged by network controls:

// Hunt: Firewall/syslog telemetry showing ICS protocol traffic crossing zone boundaries
// Works with CommonSecurityLog (CEF) ingestion from firewalls and OT monitoring sensors.
let ICSPorts = dynamic([102, 502, 20000, 44818, 47808]);
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort in (ICSPorts)
| extend SourceZone = coalesce(DeviceCustomString1, "unknown")  // map zone field per your CEF parser
| where SourceZone !contains "OT"                               // alert on IT-origin traffic only
| summarize Hits = count(),
    Sources = make_set(SourceIP),
    Destinations = make_set(DestinationIP),
    Ports = make_set(DestinationPort),
    Actions = make_set(DeviceAction)
  by DeviceVendor, DeviceProduct, bin(TimeGenerated, 1h)
| order by Hits desc;

Velociraptor VQL

Use this artifact to hunt live for endpoints holding active connections to ICS protocol ports — the fastest way to find a pivot in progress during an IR engagement in a converged environment.

-- Hunt: Endpoints with active connections to ICS/OT protocol ports
-- Scope across the fleet; expect hits only on engineering workstations,
-- HMIs, SCADA servers, and sanctioned OT scanners. Anything else is a lead.
SELECT Pid,
       Name,
       Exe,
       Username,
       netstat().LocalIP AS LocalIP,
       netstat().LocalPort AS LocalPort,
       netstat().RemoteIP AS RemoteIP,
       netstat().RemotePort AS RemotePort,
       netstat().Status AS Status
FROM pslist()
WHERE netstat().RemotePort in (102, 502, 20000, 44818, 47808)
  AND netstat().Status = 'ESTABLISHED'
ORDER BY RemoteIP

Follow up on hits by pulling process lineage and command lines for any unexpected source processes:

-- Follow-up: Process tree context for any suspicious PID identified in the ICS port hunt
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Pid = <SUSPECT_PID> OR Ppid = <SUSPECT_PID>

Hardening Script

This PowerShell script audits and hardens a Windows engineering workstation or IT/OT boundary host: disables SMBv1 (a common pivot enabler in legacy estates), enables command-line process auditing (required for the Sigma rules above to fire), and inventories established ICS-port connections for review.

# Critical Infrastructure Boundary Host Hardening Audit
# Run elevated. Test in a maintenance window before production OT deployment.

# 1. Disable SMBv1 — legacy OT-adjacent systems frequently still expose it,
#    and it remains a favorite lateral-movement channel.
$smb1 = Get-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -ErrorAction SilentlyContinue
if ($smb1 -and $smb1.State -eq 'Enabled') {
    Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol -NoRestart
    Write-Output "[FIXED] SMBv1 disabled. Reboot required."
} else {
    Write-Output "[OK] SMBv1 not enabled."
}
Set-SmbServerConfiguration -EnableSMB1Protocol $false -Force -ErrorAction SilentlyContinue

# 2. Enable process creation auditing with command-line capture (Event 4688)
#    — prerequisite for the Sigma detections in this post.
auditpol /set /subcategory:"Process Creation" /success:enable /failure:disable
$cmdlinePath = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit'
if (-not (Test-Path $cmdlinePath)) { New-Item -Path $cmdlinePath -Force | Out-Null }
Set-ItemProperty -Path $cmdlinePath -Name 'ProcessCreationIncludeCmdLine_Enabled' -Value 1
Write-Output "[OK] Process creation auditing with command line enabled."

# 3. Restrict outbound access to ICS ports — engineering hosts should be the
#    ONLY systems permitted to initiate OT protocol connections.
$icsPorts = 102,502,20000,44818,47808
foreach ($port in $icsPorts) {
    $ruleName = "OT-EGRESS-AUDIT-TCP-$port"
    if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
        # Log-only first: change to -Action Block after validating engineering traffic
        New-NetFirewallRule -DisplayName $ruleName -Direction Outbound -Protocol TCP `
            -RemotePort $port -Action Allow -Profile Any -Enabled True | Out-Null
    }
}
Write-Output "[OK] Outbound ICS-port rules staged in audit posture. Flip to Block after baseline."

# 4. Report current established connections to ICS ports for immediate triage
Write-Output "`n[REVIEW] Established ICS-port connections on this host:"
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -in $icsPorts } |
    Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess |
    Format-Table -AutoSize

Remediation: Closing the Visibility Gap

There is no patch for an asset inventory problem. The remediation here is programmatic, and it aligns directly with what CISA has been urging critical infrastructure operators to do. Prioritize in this order:

1. Build a Continuous, Passive OT Asset Inventory (Highest Priority)

• Deploy passive network monitoring purpose-built for OT (Tenable.ot, Claroty, Dragos, or open-source Zeek with ICS protocol analyzers) at OT DMZ and cell-area choke points. Passive discovery will not crash legacy devices the way active scanning can.
• Reconcile against engineering records. Your passive inventory will find devices your documentation doesn't know about. That delta is your risk register.
• Feed discovered assets into your CMDB and vulnerability management platform so OT devices get tracked with the same rigor as IT endpoints.

2. Segment and Enforce the IT/OT Boundary

• Implement or validate a true OT DMZ per IEC 62443 zones-and-conduits: no direct IT-to-OT sessions; all access brokered through hardened jump servers with MFA.
• Deploy firewall rules defaulting to deny for ICS protocol ports from non-engineering sources — exactly what the detections above assume.
• Eliminate dual-homed hosts spanning IT and OT. Every one you find is a pre-built adversary bridge.

3. Assume AI-Speed Reconnaissance — Compress Your Detection Window

• Alert on discovery command clusters (first Sigma rule above) rather than individual commands. Machine-speed enumeration is distinguishable from human admin activity precisely by its density.
• Reduce mean-time-to-detect on boundary-host telemetry to minutes, not days. If your OT DMZ logs are still batch-reviewed weekly, an AI-assisted adversary has already finished.
• Treat theft of operational information — bulk access to engineering drawings, HMI project files, historian exports — as a reportable incident, not noise. That data is the payload that makes future OT disruption possible.

4. Apply CISA's Cross-Sector Guidance

• Work through CISA's Cross-Sector Cybersecurity Performance Goals (CPGs) — they are deliberately written as an achievable baseline for resource-constrained critical infrastructure operators.
• Review CISA's joint advisories on nation-state pre-positioning in critical infrastructure and map your detection coverage to the documented TTPs (ATT&CK for ICS T0846, T0840, T0867, T0888).
• For water, energy, healthcare, and transportation operators: validate your incident reporting obligations and pre-establish contacts with CISA regional offices before you need them. Reference: https://www.cisa.gov/critical-infrastructure and https://www.cisa.gov/resources-tools/resources/cybersecurity-performance-goals

5. Address the Legacy Patching Reality

• Where patching legacy OT is operationally impossible, apply compensating controls: virtual patching via industrial IPS/IDS at the conduit, application allowlisting on engineering workstations, and strict protocol allowlists at zone boundaries.
• Track vendor security advisories for your specific PLC/RTU/HMI fleet (Siemens, Rockwell, Schneider Electric, ABB all publish regular ICS advisories, frequently mirrored as CISA ICS advisories at https://www.cisa.gov/news-events/cybersecurity-advisories).

The Bottom Line

The Tenable analysis is a warning that the reconnaissance asymmetry has shifted permanently. Nation-state actors with AI-assisted tooling will know your converged network better than you do — unless you close the visibility gap first. The defensive play is unglamorous but decisive: continuous passive asset discovery, enforced segmentation at the IT/OT boundary, and behavioral detection tuned for machine-speed enumeration on the hosts that bridge the two worlds.

If your SOC can't answer "how many OT devices are reachable from the corporate network right now?" within an hour, that is your first remediation task — before any tool purchase, before any framework assessment.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub