Abstract:An Industrial Control System (ICS) adversary often takes different actions to exploit vulnerabilities, pass the border between Information Technology (IT) and Operational Technology (OT) networks, and launch a targeted attack against OT networks. Detecting these threat actions in early phases before the final stage of the attacks can be executed against industrial endpoints can help prevent adversaries from achieving their goals. Threat hunting in IT networks has been previously studied, and several hunting methods have been proposed. However, these methods are not sufficient for ICSs, as the integration of industrial legacy systems with advanced IT networks has introduced new types of vulnerabilities and changed the behaviour of attacks. The lack of a unified hunting solution for integrated IT and OT networks is the gap that is considered in our paper. The contribution of this paper is an ICS Threat Hunting Framework (ICS-THF) which focuses on detecting cyber threats against ICS devices in the earliest phases of the attack lifecycle. ICS-THF consists of three stages, threat hunting triggers, threat hunting, and cyber threat intelligence. The threat hunting trigger stage identifies events or external resources that can trigger the hunting stage. The hunting stage uses a combination of the MITRE ATT&CK Matrix and a Diamond model of intrusion analysis to generate a hunting hypothesis and to predict the future behaviour of the adversary. This hypothesis will be validated by analysing Diamond models of threat actions. Finally, the cyber threat intelligence stage is responsible for generating Indicators of Compromise (IoCs) to be used for future threat hunting. The Black Energy 3 malware, PLC-Blaster malware, and SWaT dataset are used in this paper to evaluate the efficiency of the proposed framework.

A Novel Framework for Industrial Control System Malicious Code Analysis

Text Classification and Threat Intelligence Generation for Industrial Control System Security

Network Security Situation Awareness for Industrial Control System under Integrity Attacks

Threat Assessment for Power Industrial Control System Based on Descriptive Vulnerability Text

Identification of ICS Security Risks Toward the Analysis of Packet Interaction Characteristics Using State Sequence Matching Based on SF-FSM

An Analytics Framework for Heuristic Inference Attacks against Industrial Control Systems

An Improved Support Vector Machine Attack Detection Algorithm for Industry Controls System

A Deep Learning-based Framework for Conducting Stealthy Attacks in Industrial Control Systems

Improving IIoT security: Unveiling threats through advanced side-channel analysis

Threat and defense of new ransomware worm in industrial control system

NIPAD: a Non-Invasive Power-Based Anomaly Detection Scheme for Programmable Logic Controllers

An evaluation framework for industrial control system cyber incidents

Research on Attack Mechanism of Network Intrusion in Industrial Control System

An IIoT-Based Networked Industrial Control System Architecture to Secure Industrial Applications

ICSML: Industrial Control Systems ML Framework for native inference using IEC 61131-3 code

Modeling of malicious code propagation in the industrial control network

Securing Industrial Control Systems: Components, Cyber Threats, and Machine Learning-Driven Defense Strategies

A Unified Architectural Approach for Cyberattack-Resilient Industrial Control Systems

Control Behavior Integrity for Distributed Cyber-Physical Systems

A Threat Hunting Framework for Industrial Control Systems

Towards Low-Barrier Cybersecurity Research and Education for Industrial Control Systems