Threat Hunting Part 2: Hunting on ICS Networks

This post provides practical guidance for ICS threat hunting using the Purdue Model, mapping Levels 4 to 0 to appropriate data sources, tools, and behavioral baselines. It recommends passive monitoring at the control system level, deep inspection of OT protocols alongside IT telemetry, and focused scrutiny of inter-level activity (e.g., domain trust, RDP, SMB) to detect adversary movement. By leveraging the constrained and role-specific communications of OT environments and automating protocol analytics, defenders can improve visibility and raise attacker costs.