Skip to main content
OT Atlas
Search

Hunt playbook

Unexpected Controller Logic Changes

Detect differences between the running controller logic and the approved engineering baseline.

AdvancedT0836T0839

Hypothesis

Running controller logic may differ from the approved baseline without a recorded change.

Why this hunt matters

Logic changes may be introduced without a network event you captured — periodic comparison catches what monitoring missed.

Scope

Assets: plc, dcs, safety-plc, robot-controller

Protocols: s7comm, ethernet-ip, foundation-fieldbus

Data sources required

  • Controller project exports
  • Program comparison tooling
  • Version control history
  • Change management records

Baseline needed first

  • A current, verified project archive exists for every controller
  • Comparisons run on a defined cadence with recorded results

Hunt steps

  1. 01Confirm the baseline archive is current and trusted for the controllers in scope
  2. 02Perform a comparison using vendor tooling (upload-and-compare, or checksum where offered)
  3. 03Investigate every difference: logic, tag values retained as constants, and configuration
  4. 04Correlate differences with change records and network programming events
  5. 05Document accepted differences and update the baseline formally

Indicators of interest

  • Logic differences with no change record
  • Modified alarm or interlock conditions
  • New or altered forced values
  • Timestamps outside working periods

Triage

  • Does the difference change process behaviour?
  • Does it affect an interlock, alarm or safety function?
  • Who had access in the relevant period?

Likely false positives

  • Legitimate changes with paperwork not filed
  • Baseline archives that were never updated after an approved change
  • Compiler/version artefacts in comparison output

Escalation

  • Interlock or alarm logic changed
  • Any safety-related difference
  • Differences across multiple controllers

Containment options

  • Engage engineering before reverting anything
  • Assess process impact before restoring a previous program

Validation

  • Baseline updated and re-verified
  • Comparison automation scheduled
  • Change process reinforced with the team

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.