Hunt playbook
Safety System Communication Anomalies
Detect any unexpected communication, configuration change or state change involving safety systems.
ExpertT0880T0858
Hypothesis
Communication with or configuration of a safety system may be occurring outside approved activity.
Why this hunt matters
Safety systems are the last protection layer; anomalies here carry the highest possible consequence.
Scope
Assets: sis, safety-plc, protective-relay
Protocols: cip-safety, goose, profinet, modbus-tcp
Data sources required
- Safety controller logs
- Safety network monitoring
- Bypass/override records
- Change management
- Keyswitch state where reported
Baseline needed first
- Safety systems communicate with a defined, minimal peer set and change only during formal management-of-change
Hunt steps
- 01List all peers that communicated with safety systems in the period
- 02Compare against the documented safety architecture
- 03Review every safety program, parameter or bypass change
- 04Check keyswitch/mode state history
- 05Correlate safety trips with any preceding network or configuration activity
Indicators of interest
- A new peer to a safety controller
- Program mode enabled
- Bypasses active without records
- Trips with no identified process cause
- TriStation traffic to a Schneider Triconex controller on 1502/UDP from anything other than the designated safety engineering workstation, or the Tricon keyswitch left in PROGRAM — the exact precondition exploited by TRITON
- Siemens F-CPU PROFIsafe passivation events, or a safety program download to an S7-1500F outside management-of-change
Triage
- Is a formal management-of-change record open?
- Which safety function is involved?
- Has the protection layer been weakened?
Likely false positives
- Proof testing
- Approved SIF modifications
- Vendor service work
Escalation
- Any unexplained safety change — escalate immediately to operations, engineering and safety leadership
Containment options
- Never modify safety systems unilaterally; safety and process authorities lead the decision
Validation
- Safety function verified by proof test
- Change records reconciled
- Alarming on safety changes confirmed
Why should I care?
Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.