​​Investigating industrial control systems using Microsoft’s ICSpector open-source framework

The report introduces **ICSpector**, an open-source Python framework from Microsoft that helps ICS/OT defenders and engineers identify, extract, and analyze PLC project configurations and logic to detect anomalous or malicious changes (e.g., timestamp outliers, authorship, task flow, network capabilities, and online vs. offline code diffs). It explains the unique challenges of ICS forensics versus IT, details ICSpector’s modular architecture (input handling, network scanner, protocol plugins, analyzer, output), current protocol support (Siemens S7Comm, Rockwell RSLogix/CIP, Codesys V3), and safe-use considerations, and positions it as a complement to solutions like **Microsoft Defender for IoT**, while inviting community contributions to expand protocols and analytics.