Skip to main content
OT Atlas
Search

Hunt playbook

Suspicious Remote Access into OT

Identify remote sessions into the OT environment that lack a named user, approval, or business justification.

FoundationalT0822T0886

Hypothesis

A remote session into OT may be occurring without approval or without a legitimate named user.

Why this hunt matters

Remote access is repeatedly documented as an initial access path into OT environments.

Scope

Assets: remote-access-gateway, jump-server, hmi, dcs

Protocols:

Data sources required

  • Remote access gateway logs
  • Jump host session records
  • Identity provider / MFA logs
  • Firewall logs at the DMZ boundary
  • Change and work-order records

Baseline needed first

  • Named accounts only
  • Sessions during declared support windows
  • Each session maps to a ticket or work order

Hunt steps

  1. 01List all sessions into OT for the period with identity, source, destination and duration
  2. 02Filter to out-of-hours, unusually long, or unusual-destination sessions
  3. 03Check each against approvals and work orders
  4. 04Verify MFA was satisfied and not bypassed by an exception path
  5. 05Look for direct-to-destination traffic that bypassed the jump host entirely

Indicators of interest

  • Shared or generic account names
  • Access from an unexpected geography or ASN
  • Sessions reaching engineering or safety systems
  • Bypass of the designated jump host

Triage

  • Who is the human behind the account?
  • What was reached and what was done?
  • Was any control-affecting action taken?

Likely false positives

  • Genuine emergency support
  • Scheduled vendor maintenance not recorded in the ticket system
  • Monitoring integrations using service accounts

Escalation

  • No identifiable human
  • Access to safety or engineering systems
  • MFA bypass observed

Containment options

  • Disable the account pending verification
  • Coordinate with operations before terminating an active support session

Validation

  • Vendor access set to default-off
  • Bypass paths removed from firewall rules
  • Session logging verified end to end

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.