Threat Hunting With Python Part 4: Examining Microsoft SQL Based Historian Traffic

The post explains how the Tabular Data Stream (TDS) protocol underpins Microsoft SQL Server communications in ICS historians and demonstrates using Python (pyshark and pandas) to parse PCAPs, enumerate SQL queries and RPC procedure calls, and baseline normal behavior to detect anomalies—flagging suspicious statements like DROP TABLE or CREATE USER and emphasizing ongoing monitoring of TDS traffic for threat hunting.