Hunt playbook
Abnormal Authentication in OT
Identify authentication patterns in the OT environment that do not match normal operational behaviour.
IntermediateT0859T0822
Hypothesis
An account may be authenticating from unexpected hosts, at unexpected times, or in unexpected volumes.
Why this hunt matters
Credential abuse is a recurring theme in documented OT intrusions, often using entirely legitimate access.
Scope
Assets: domain-controller-ot, hmi, scada-server, jump-server
Protocols:
Data sources required
- OT domain controller logs
- Local host authentication logs
- Jump host records
- Identity provider logs
- Application logins (SCADA/HMI)
Baseline needed first
- Shift-aligned operator logons; engineers on engineering hosts; service accounts non-interactive
Hunt steps
- 01Profile logon patterns per account and per host over a stable period
- 02Flag interactive logons by service accounts
- 03Flag accounts authenticating to hosts they have never used
- 04Review failed-logon spikes and lockouts
- 05Correlate with remote access sessions
Indicators of interest
- Service account interactive logon
- Administrator logon to an HMI
- Out-of-shift operator logons
- Authentication from the enterprise network into OT hosts
Triage
- Is the account's owner working?
- What was accessed afterwards?
- Was MFA involved?
Likely false positives
- Shift swaps and overtime
- Maintenance activity
- Monitoring agents using service credentials
Escalation
- Privileged access to control-capable systems
- Authentication chains crossing the IT/OT boundary
Containment options
- Reset credentials in coordination with operations — some accounts run production processes
Validation
- Service account interactive logon blocked by policy
- Named accounts enforced
- MFA coverage verified
Why should I care?
Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.