OT Cybersecurity Intrusion Analysis FROSTYGOOP Modbus

FROSTYGOOP Modbus Intrusion Analysis
What you'll learn

---

Explain how OT intrusion analysis differs from IT investigation, including the data sources that are unique to industrial environments.
Read a Modbus TCP capture in Wireshark and identify unauthorized reconnaissance and write activity by function code, source IP, and register range
Describe what FrostyGoop is, how it operates, and why it caused physical impact.
Correlate SCADA historian data against an independent field sensor to detect falsified process values.
Trace an attacker's path across the IT and OT boundary using firewall, VPN, and host-artifact logs.
Build a consolidated incident timeline mapped to MITRE ATT&CK for ICS
Produce a prioritized list of detection and segmentation improvements grounded in the evidence.
Requirements

---

This module assumes you are comfortable with basic TCP/IP and Wireshark navigation. If you have not done the Tier 1 Modbus TCP Exploitation module, I recommend completing that first - this module builds directly on that foundation.
Description

---

By the end of this module, you will be able to do seven things. First: explain how OT intrusion analysis differs from IT investigation, including the data sources that are unique to industrial environments. Second: read a Modbus TCP capture in Wireshark and identify unauthorized reconnaissance and write activity by function code, source IP, and register range. Third: describe what FrostyGoop is, how it operates, and why it caused physical impact. Fourth: correlate SCADA historian data against an independent field sensor to detect falsified process values. Fifth: trace an attacker's path across the IT and OT boundary using firewall, VPN, and host-artifact logs. Sixth: build a consolidated incident timeline mapped to MITRE ATT&CK for ICS. And seventh: produce a prioritized list of detection and segmentation improvements grounded in the evidence.
The evidence pack for this module is the FrostyGoop Evidence Set - a simulated but structurally faithful collection of a PCAP, a SCADA historian CSV, an independent field sensor CSV, a perimeter router syslog, an OT firewall log, and two host artifacts from the compromised workstation. it from the resources section of this lecture.
One prerequisite note: this module assumes you are comfortable with basic TCP/IP and Wireshark navigation. If you have not done the Tier 1 Modbus TCP Exploitation module, I recommend completing that first - this module builds directly on that foundation
Overall you will learn to conduct Intrusion Analysis, Intrusion Detection Engineering, Network Traffic Analysis, etc.
Who this course is for

---

OT Cybersecurity professionals who want to enhance their Intrusion Analysis and Incident Response skills.
Also any other Cybersecurity professionals who want to learn these skills.
Homepage

---