↓ Skip to main content
Cutaway Security
Cutaway Security

ICS410

Table of Contents

Welcome to the CutSec SANS ICS410 resources page. These are just a few extra online resources and items that didn’t make it into the class. We hope these help your ICS / OT cybersecurity journey. Contact us if you have something to add or a suggestion.

Quick Reference Links#

Certification Study Links#

Books
#

Important OT Podcasts, Talks, and Interviews
#

General Topic Links#

Equipment Links#

Purdue Level 0/1 Links#

Attack Consequence Videos
#

Attacks on Remote Sites
#

General
#

Water
#

Electrical
#

Nuclear
#

Rail
#

Ports
#

  • Inside Job: How a Hacker Helped Cocaine Traffickers Infiltrate Europe’s Biggest Ports (Insider Threat)

Food/Beverage
#

ICS Vendor
#

Physical Security Links#

Managing Your IR Efforts
#

  • What are your goals?
  • What questions help you achieve your goals?
  • What data would answer those questions?
  • How do you acquire that data?

Incident Response Table Top Links#

Velocio and PLC Links#

Network Links#

Radio Links#

Remote Access Links#

Just a few solutions to help start research into remote access solutions. These are not a recommendation, just links to the solutions.

NBAD / Asset Management Links
#

Just a few solutions to help start research into asset management and Network Behavior Anomaly Detection (NBAD) solutions. These are not a recommendation, just links to the solutions.

Software Bill of Materials (SBOM) Links#

Just a few solutions to help start research into Software Bill of Materials (SBOM) solutions. These are not a recommendation, just links to the solutions.

Josh Wright Links#

Jason Larsen Videos
#

Monta Elkins
#

Justin Searle Videos
#

Paul Piotrowski Links#

Mike Hoffman Videos
#

Don C. Weber Videos
#

Podcasts
#

TShark Commands
#

Industrial Control Protocols
#

Purpose:

  • Identify master servers and client / slaves
  • Identify common protocols in use by master servers
  • Also want to identify proprietary protocols in use, but this will be more difficult as Wireshark / Tshark may not have protocol dissectors for their identification and analysis.
# Modbus

## Masters
tshark -n -Y "mbtcp && tcp.dstport == 502" -T fields -e ip.src -r <file.pcap> | sort | uniq
## Masters with function codes
tshark -n -Y "mbtcp && tcp.dstport == 502" -T fields -e ip.src -e modbus.func_code -r <file.pcap> | sort | uniq
## Slaves
tshark -Y "mbtcp && tcp.dstport == 502" -T fields -e ip.dst -e eth.dst -r <file.pcap> | sort | uniq
### Note: The OUI hardware address does not resolve for field outputs. You have to check them yourself.
tshark -Y "mbtcp && tcp.dstport == 502" -T fields -e ip.dst -r <file.pcap> | sort | uniq | wc -l

# Aveva / WonderWare SuiteLink
## Servers
tshark -Y "tcp.dstport == 5413" -T fields -e ip.dst -r <file.pcap> | sort | uniq
## Clients
tshark -Y "tcp.dstport == 5413" -T fields -e ip.src -r <file.pcap> | sort | uniq

# Aveva / WonderWare InBatch
## Servers
tshark -Y "tcp.dstport >= 9000 && tcp.dstport >= 9015" -T fields -e ip.dst -r <file.pcap> | sort | uniq
# Clients
tshark -Y "tcp.dstport >= 9000 && tcp.dstport >= 9015" -T fields -e ip.src -r <file.pcap> | sort | uniq

# BACnet
## I-Am responses to Who-Is - sorted by source IP address
tshark -d udp.port==47809,bvlc -Y 'bacapp.unconfirmed_service == 0' -T fields -e ip.src -e bacapp.instance_number -e bacnet.sadr_mstp -e bacnet.snet -E separator=, -r <file.pcap> | sort | uniq | sort -g -t. -k 1,1 -k 2,2 -k 3,3 -k 4,4
## Device Count BACnet source
tshark -d udp.port==47809,bvlc -Y 'bacnet' -T fields -e ip.src -e ip.dst -r <file.pcap> | grep -v ',' | sort | uniq > <file.pcap>
### NOTE: The resulting file still needs to be counted. Probably best to export Wireshark filtered communications to an MS Excel file and do a pivot table.

There are no articles to list here yet.