New Dragos Knowledge Pack: The Latest Industrial, Threat, and Device Data

Dragos released a Knowledge Pack update for Platform customers that expands ICS/OT protocol inspection (including DeltaV DOP, Schneider Electric Triconex, and BACnet), introduces multiple new threat detections (e.g., Tristation Halt command, Metasploit CIP, BACnet anomalies, authentication brute force after C2, C2 after exploitable file download, port sweeps, SSH reverse tunneling, GE SRTP alerts), and improves characterizations such as GE protocol identification and executable file detection; the packs also include the latest Dragos threat intelligence indicators of compromise and MITRE ATT&CK for ICS mapping.