Skip to main content
OT Atlas
Search

Hunt playbook

Industrial Protocol Write Activity

Surface write operations on industrial protocols and confirm each has an operational reason.

IntermediateT0855T0831

Hypothesis

Write operations may be occurring from clients that should only read, or to points outside their normal scope.

Why this hunt matters

Reads are routine; writes change the process. Separating the two is one of the highest-value OT detections.

Scope

Assets: plc, rtu, vfd, hmi

Protocols: modbus-tcp, umas, dnp3, bacnet, hart-ip, mc-protocol

Data sources required

  • Passive protocol inspection with function-code visibility
  • SCADA operator action logs
  • Alarm and event journals

Baseline needed first

  • Which clients legitimately write, to which devices, and which registers/points

Hunt steps

  1. 01Aggregate protocol traffic by source, destination and function code
  2. 02Identify sources performing writes and compare against the expected writer list
  3. 03For expected writers, compare the target point ranges with their normal scope
  4. 04Correlate spikes in write activity with operator actions and alarms

Indicators of interest

  • Writes from a historian or reporting host
  • Writes to points outside a client's normal range
  • Bursts of writes in a short period
  • Modbus function code 90 (Schneider UMAS) on 502/TCP from any host that normally issues only function codes 3, 4 and 16 — port-only rules will not show this

Triage

  • What does the point control?
  • Was there an operator action or automated sequence?
  • Did the process value change?

Likely false positives

  • Heartbeat/watchdog writes
  • Time synchronisation points
  • Recipe downloads at batch start

Escalation

  • Writes to safety-related or high-consequence points
  • Writes from a host with no operational role

Containment options

  • Confirm process state with operations
  • Constrain the client's conduit if it has no write requirement

Validation

  • Writer inventory documented
  • Read-only conduits enforced where possible

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.