Abstract:An Industrial Control System (ICS) adversary often takes different actions to exploit vulnerabilities, pass the border between Information Technology (IT) and Operational Technology (OT) networks, and launch a targeted attack against OT networks. Detecting these threat actions in early phases before the final stage of the attacks can be executed against industrial endpoints can help prevent adversaries from achieving their goals. Threat hunting in IT networks has been previously studied, and several hunting methods have been proposed. However, these methods are not sufficient for ICSs, as the integration of industrial legacy systems with advanced IT networks has introduced new types of vulnerabilities and changed the behaviour of attacks. The lack of a unified hunting solution for integrated IT and OT networks is the gap that is considered in our paper. The contribution of this paper is an ICS Threat Hunting Framework (ICS-THF) which focuses on detecting cyber threats against ICS devices in the earliest phases of the attack lifecycle. ICS-THF consists of three stages, threat hunting triggers, threat hunting, and cyber threat intelligence. The threat hunting trigger stage identifies events or external resources that can trigger the hunting stage. The hunting stage uses a combination of the MITRE ATT&CK Matrix and a Diamond model of intrusion analysis to generate a hunting hypothesis and to predict the future behaviour of the adversary. This hypothesis will be validated by analysing Diamond models of threat actions. Finally, the cyber threat intelligence stage is responsible for generating Indicators of Compromise (IoCs) to be used for future threat hunting. The Black Energy 3 malware, PLC-Blaster malware, and SWaT dataset are used in this paper to evaluate the efficiency of the proposed framework.

Integration of Cyber Threat Intelligence into Security Onion and Malcolm for the use case of industrial networks

Text Classification and Threat Intelligence Generation for Industrial Control System Security

Understanding Indicators of Compromise against Cyber-Attacks in Industrial Control Systems: A Security Perspective

A Cyber Threat Intelligence Management Platform for Industrial Environments

A Threat Hunting Framework for Industrial Control Systems

Putting Together the Pieces: A Concept for Holistic Industrial Intrusion Detection

A Machine Learning based Threat Intelligence Framework for Industrial Control System Network Traffic Indicators of Compromise

Real-Time Intrusion Detection Based on Decision Fusion in Industrial Control Systems

Vulnerabilities and Attacks Against Industrial Control Systems and Critical Infrastructures

Assessment of Cyber-Physical Intrusion Detection and Classification for Industrial Control Systems

Leveraging Data Fitting and Trust Assessment to Improve the Security of Industrial Networks

Towards Cyber Threat Intelligence for the IoT

Cybersecurity for Industrial Control Systems: A Survey

Industrial Control Systems Security Validation Based on MITRE Adversarial Tactics, Techniques, and Common Knowledge Framework

A Security Framework in Digital Twins for Cloud-based Industrial Control Systems: Intrusion Detection and Mitigation

Looking back to look forward: Lessons learnt from cyber-attacks on Industrial Control Systems

Enhancing Cyber-Threat Intelligence in the Arab World: Leveraging IoC and MISP Integration

Using machine learning to detect network intrusions in industrial control systems: a survey

A Hierarchical Intrusion Detection System for Industrial Control Networks based on EtherNet/IP

A Blockchain-Enabled Incentivised Framework for Cyber Threat Intelligence Sharing in ICS