Ukraine's government has announced a partnership with OpenAI — codenamed Daybreak — to automate cybersecurity functions across critical infrastructure, with power grids and water systems explicitly named as the protected assets, according to reporting by CyberScoop. A Ukrainian official confirmed the tools will be used to automate defensive cyber functions while the war with Russia continues.
This is not a policy whitepaper. It is a wartime operational decision by the country that has absorbed more destructive ICS/OT cyberattacks than any nation in history — the 2015 and 2016 grid takedowns (BlackEnergy, Industroyer/CrashOverride), Industroyer2 in 2022, and a sustained campaign of wiper malware (CaddyWiper, WhisperGate, AcidRain) against energy, telecom, and government networks. When Kyiv decides that AI-augmented defense is worth deploying against live adversaries in OT environments, every security team responsible for critical infrastructure anywhere should pay attention.
Three reasons this matters to defenders outside Ukraine:
- The adversary is shared. The Russian state actors targeting Ukrainian power and water — Sandworm (APT44, FROZENBARENTS), tracked by Mandiant as the most prolific disruptive OT actor of the last decade — conduct reconnaissance and capability development against NATO-member and allied infrastructure continuously. TTPs proven in Ukraine historically migrate westward.
- OT environments are chronically under-monitored. Most water utilities and regional power operators cannot staff 24/7 SOC coverage. Automating triage, detection engineering, and threat-intel correlation — exactly what Daybreak targets — is the only realistic path to parity.
- The window is now. Water systems in the US and EU have faced escalating intrusion activity (CISA, EPA, and FBI joint advisories through 2025 documented continued targeting of water sector HMIs and exposed PLCs). Attackers probe soft OT targets precisely because detection maturity is low.
This post breaks down the threat context, then gives you deployable detection content for the exact TTPs used against Ukrainian power and water infrastructure — the same tradecraft Daybreak is being built to counter.
Threat Context: What Daybreak Is Actually Defending Against
No CVEs are associated with this announcement — the story is about operational capability, not a patchable flaw. The relevant threat model is the documented Russian playbook against Ukrainian critical infrastructure:
Adversary: Sandworm / APT44
- Mandiant's 2024–2025 assessment elevated Sandworm activity to APT44 and documented its dual mission: espionage and wartime disruptive/destructive operations, including OT attacks coordinated with kinetic strikes on the Ukrainian grid.
- Industroyer2 (2022): Abused the IEC-60870-5-104 (IEC-104) protocol — TCP/2404 — to issue commands directly to electrical substation relays. Notably, it required no vulnerability at all; it spoke the native OT protocol from compromised IT-side hosts.
- Wiper staging: CaddyWiper and related families were deployed via Group Policy and scheduled tasks from domain controllers immediately before or alongside OT operations, destroying the IT systems operators depend on for visibility and recovery.
- Living-off-the-land in the IT-to-OT path: Compromise typically enters through IT (phishing, exposed VPN/edge devices), escalates to domain dominance, then pivots through jump hosts into the OT DMZ.
Why Power and Water Specifically
Water utilities and municipal power operators share structural weaknesses: flat or weakly segmented networks between business IT and control systems, legacy HMIs running unpatchable Windows, engineering workstations with standing access to PLCs/RTUs, and remote access (often vendor-managed RDP or VPN) that is poorly logged. IEC-104 (2404), Modbus (502), and DNP3 (20000) traffic from a host that isn't a known engineering station is a high-fidelity anomaly — if anyone is watching. Usually, no one is.
What AI-Augmented Defense Changes
The practical defensive functions Daybreak-style automation addresses — and that any mature SOC should already be pursuing — are: triaging high-volume telemetry from environments too thinly staffed to watch manually; translating threat intelligence into detection logic at machine speed; correlating low-signal IT-side events (a wiper precursors, anomalous GPO changes) with OT-side anomalies (unexpected IEC-104 commands); and accelerating incident summarization and response coordination during an active intrusion, where hours determine whether a substation stays online.
Detection & Response
The detections below target the observable behaviors of the documented Ukrainian OT intrusion playbook: wiper staging via scheduled tasks and GPO, and unauthorized ICS protocol traffic crossing the IT/OT boundary. These are the behaviors your SOC should catch before an Industroyer-class payload ever runs.
Sigma Rules
---
title: Suspicious Scheduled Task Creation From Domain Controller Context
description: Detects creation of scheduled tasks with execution flags consistent with wiper/destructive malware staging via GPO or PsExec-style deployment from privileged infrastructure, a pattern used by Sandworm (APT44) to deploy CaddyWiper and related families across Ukrainian networks.
references:
- https://attack.mitre.org/techniques/T1053/005/
- https://attack.mitre.org/techniques/T1485/
- https://www.mandiant.com/resources/blog/ukraine-cyber-threat-landscape
logsource:
category: process_creation
product: windows
detection:
selection_cmd:
Image|endswith:
- '\schtasks.exe'
- '\powershell.exe'
- '\pwsh.exe'
CommandLine|contains:
- '/create'
- 'New-ScheduledTask'
- 'Register-ScheduledTask'
selection_suspicious_exec:
CommandLine|contains:
- '\\*\C$\'
- '\\*\ADMIN$\'
- 'C:\Windows\Temp\'
- 'C:\Users\Public\'
- '/ru SYSTEM'
- '/tn '
condition: selection_cmd and selection_suspicious_exec
falsepositives:
- Enterprise software deployment tools (SCCM, Intune) creating tasks under SYSTEM
- Legitimate administrative scripts using known internal share paths
level: high
---
title: Raw Disk Access By Non-System Process (Potential Wiper Activity)
description: Detects direct raw disk handle access (PhysicalDrive) by processes outside a small allowlist, consistent with destructive wiper malware observed in campaigns against Ukrainian critical infrastructure. Correlate with mass file rename/delete events on the same host.
references:
- https://attack.mitre.org/techniques/T1561/002/
- https://attack.mitre.org/techniques/T1485/
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- '\\.\PhysicalDrive'
- '\\?\PhysicalDrive'
- '\Device\Harddisk'
filter_legit:
Image|endswith:
- '\vssadmin.exe'
- '\wbadmin.exe'
- '\fsutil.exe'
- '\diskpart.exe'
condition: selection and not filter_legit
falsepositives:
- Backup and disk-imaging software (Veeam, Acronis) — allowlist by signer and path
- Forensic tooling during authorized IR
level: critical
---
title: ICS Protocol Traffic From Non-Engineering Host (Network Boundary Violation)
description: Detects network connections to standard ICS/SCADA ports (IEC-104 2404, Modbus 502, DNP3 20000, EtherNet/IP 44818) initiated by processes on general-purpose Windows hosts. Industroyer2 issued IEC-104 commands from compromised IT-side systems; any non-engineering workstation speaking these protocols to OT assets is a high-fidelity anomaly.
references:
- https://attack.mitre.org/techniques/T0883/
- https://attack.mitre.org/techniques/T0855/
- https://attack.mitre.org/techniques/T0886/
logsource:
category: network_connection
product: windows
detection:
selection_ports:
DestinationPort:
- 502
- 2404
- 20000
- 44818
filter_engineering:
Image|endswith:
- '\s7otbxdx.exe'
- '\CCHVACUtility.exe'
- '\KEPServerEX.exe'
- '\kpsmain.exe'
condition: selection_ports and not filter_engineering
falsepositives:
- Authorized SCADA vendor tools not in the allowlist — build your environment-specific engineering workstation/tool baseline before enabling at high level
- Vulnerability scanners during authorized OT assessments
level: high
KQL (Microsoft Sentinel / Defender)
Hunt for ICS protocol connections sourced from hosts that have no business talking to OT assets. This works against ingested firewall/NSG/syslog telemetry (CommonSecurityLog) and Defender for Endpoint network events — the latter is your best bet for process attribution on the source host.
// Hunt: Non-engineering hosts initiating ICS protocol connections (IT/OT boundary violation)
let IcsPorts = dynamic([502, 2404, 20000, 44818]);
// Baseline: maintain a watchlist of authorized engineering workstations / jump hosts
let EngineeringHosts = dynamic(["ENG-WS01", "ENG-WS02", "SCADA-JUMP01"]);
union
(DeviceNetworkEvents
| where RemotePort in (IcsPorts)
| where DeviceName !in~ (EngineeringHosts)
| summarize ConnectionCount = count(), DistinctTargets = dcount(RemoteIP),
TargetIPs = make_set(RemoteIP, 20), Processes = make_set(InitiatingProcessFileName, 10)
by DeviceName, RemotePort, InitiatingProcessAccountName
| extend Source = "DefenderEndpoint"),
(CommonSecurityLog
| where DestinationPort in (IcsPorts)
| where DeviceAction !~ "Deny"
| summarize ConnectionCount = count(), DistinctTargets = dcount(DestinationIP),
TargetIPs = make_set(DestinationIP, 20)
by SourceIP, DestinationPort, DeviceVendor
| extend Source = "Firewall")
| order by ConnectionCount asc
Tune guidance: run this in a learning mode for two weeks to build the authorized-engineering-host baseline, then alert on any new source. In OT environments this is genuinely low-noise — legitimate IEC-104/Modbus talkers are a small, static population. A sudden new speaker, especially a domain controller or file server, is your Industroyer2 precursor.
Velociraptor VQL
Endpoint hunt across Windows hosts in the IT/OT DMZ for two things at once: processes holding live connections to ICS ports, and recently created scheduled tasks pointing at temp/public paths (wiper staging artifacts).
-- Hunt: processes with active ICS-protocol connections plus suspicious scheduled-task staging
SELECT Name, Pid, CommandLine, Username, Exe, CreateTime
FROM pslist()
WHERE Pid IN (
SELECT Pid FROM netstat()
WHERE Raddr.Port IN (502, 2404, 20000, 44818)
AND Status =~ 'ESTAB'
)
OR CommandLine =~ '(?i)(Users\\\\Public|Windows\\\\Temp|schtasks|Register-ScheduledTask)'
ORDER BY CreateTime DESC
Deploy this as a hunt across the DMZ and engineering workstation collections. Any pslist hit on the netstat join that isn't your known HMI/SCADA software stack warrants immediate host isolation and memory acquisition before remediation — OT incidents demand forensics-before-cleanup discipline.
Hardening / Verification Script
For Windows hosts in the OT DMZ and engineering workstation tier, this PowerShell verifies the segmentation and auditing controls that blunt this exact playbook. Run from an elevated prompt on a jump host or via your RMM.
# OT boundary verification and hardening check - run elevated
$icsPorts = 502, 2404, 20000, 44818
$report = @()
# 1) Verify host firewall blocks inbound ICS ports except from authorized SCADA servers
foreach ($port in $icsPorts) {
$rule = Get-NetFirewallRule -ErrorAction SilentlyContinue |
Where-Object {$_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound'} |
Get-NetFirewallPortFilter -ErrorAction SilentlyContinue |
Where-Object {$_.LocalPort -eq $port -and $_.Protocol -eq 'TCP'}
$report += [PSCustomObject]@{
Check = "Inbound ICS port $port exposure"
Status = if ($rule) { 'REVIEW - inbound rule exists for ICS port' } else { 'OK - no inbound listener rule' }
}
}
# 2) Audit policy: process creation with command line (required for the Sigma rules above)
$cmdlineAudit = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue
$report += [PSCustomObject]@{
Check = 'Command-line auditing (Event 4688)'
Status = if ($cmdlineAudit.ProcessCreationIncludeCmdLine_Enabled -eq 1) { 'OK' } else { 'FAIL - enable via GPO: Include command line in process creation events' }
}
# 3) Scheduled tasks executing from suspicious staging paths
$susTasks = Get-ScheduledTask | ForEach-Object {
$actions = $_.Actions | Where-Object {$_.Execute -match 'Users\\Public|Windows\\Temp|AppData\\Local\\Temp'}
if ($actions) { [PSCustomObject]@{Task = $_.TaskName; Path = $_.TaskPath; Action = ($actions.Execute -join '; ')} }
}
$report += [PSCustomObject]@{
Check = 'Scheduled tasks from temp/public paths'
Status = if ($susTasks) { "ALERT - $($susTasks.Count) task(s) found; investigate immediately" } else { 'OK - none found' }
}
# 4) Listening ICS ports on this host (engineering stations only should have any)
$listeners = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | Where-Object {$_.LocalPort -in $icsPorts}
$report += [PSCustomObject]@{
Check = 'Local ICS listeners'
Status = if ($listeners) { "REVIEW - listening on: $($listeners.LocalPort -join ', ')" } else { 'OK - none' }
}
$report | Format-Table -AutoSize
if ($susTasks) { $susTasks | Format-List }
Remediation and Defensive Priorities
There is no patch here — there is a posture. Prioritize in this order:
- Enforce the IT/OT boundary, then watch it. Segment control networks behind a firewall or data diode policy that permits ICS protocols (502/2404/20000/44818) only from an explicit, documented allowlist of engineering stations and jump hosts. Every connection outside that list should page a human. This single control defeats the Industroyer2 attack pattern outright.
- Eliminate standing remote access to OT. Vendor VPNs and RDP into HMIs must be time-bound, MFA-gated, and brokered through a monitored jump host with session recording. CISA's joint water-sector advisories repeatedly cite exposed remote access as the initial vector.
- Instrument for wiper precursors, not just wipers. Enable command-line process auditing (Event 4688) and forward scheduled-task creation, GPO modification, and raw-disk-access telemetry to your SIEM. The detections above depend on this logging being on before the incident.
- Adopt the Daybreak lesson: automate triage, keep humans on decisions. AI-assisted alert triage and detection-as-code pipelines are force multipliers for under-resourced utilities, but every automated containment action in OT must be pre-approved and fail-safe — an AI that kills the wrong process on an HMI is its own availability incident.
- Track the threat intelligence. Follow Mandiant's APT44 reporting, CISA's ICS advisories (ics-cert advisories feed), ESET's Industroyer2 analysis, and CERT-UA publications. Ukrainian disclosures have consistently been the earliest warning of tradecraft later seen elsewhere.
- Exercise the destructive scenario. Tabletop a combined wiper-plus-OT event: can you restore HMI/SCADA from offline backups while the grid stays in manual operation? Ukrainian operators survived Industroyer2 because manual fallback existed. Verify yours does.
Water and power operators should also review CISA's known-exploited guidance for edge devices — VPN and remote-access appliances remain the most common initial-access vector in these campaigns — and align detection coverage against MITRE ATT&CK for ICS.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.