Hunt playbook
Unauthorized PLC Programming
Identify programming or configuration operations against controllers that were not performed by an authorised engineer in an approved change window.
IntermediateT0843T0836
Hypothesis
An unauthorised system or account may be issuing programming operations to controllers.
Why this hunt matters
Controller logic defines physical behaviour. An unauthorised download is one of the highest-consequence events in an OT environment.
Scope
Assets: plc, pac, engineering-workstation, safety-plc
Protocols: s7comm, ethernet-ip, pccc, umas, profinet-dcp, pcom, ads-ams, fins
Data sources required
- Network metadata / protocol inspection
- Controller audit logs where supported
- Engineering software logs
- Change management records
- Firewall logs at the cell boundary
Baseline needed first
- Programming operations originate from a small set of named engineering hosts
- Downloads cluster in maintenance windows
- Each download corresponds to a change record
Hunt steps
- 01List every source host that used a programming-capable function toward a controller in the period
- 02Subtract the approved engineering host inventory — investigate the remainder
- 03For approved hosts, correlate each download event with a change record and an engineer
- 04Compare current controller program checksums or exported projects against the known-good baseline
- 05Review authentication events on the source hosts around each download
Indicators of interest
- Programming functions from a host that has only ever polled data
- Download events outside declared maintenance windows
- Program checksum differing from the baseline with no change record
- Engineering software launched under an unexpected account
Triage
- Which controller and which process does it control?
- Who was logged into the source host at that moment?
- Is there a matching change record and approval?
- Did process behaviour change afterwards?
Likely false positives
- Emergency changes performed without paperwork
- Vendor commissioning work on new equipment
- Engineering tools performing online edits or forced values during troubleshooting
Escalation
- No change record and no identifiable engineer
- Source host outside the engineering inventory
- Any safety controller involved
Containment options
- Coordinate with operations and engineering before any action — do not isolate a controller unilaterally
- Restrict the source host's network path if it is not required for operations
- Preserve controller project exports and host forensic evidence
Validation
- Restore or confirm the correct program with engineering sign-off
- Confirm the baseline comparison job runs and alerts
- Verify conduit rules limit programming paths
Why should I care?
Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.