Threat hunting in industrial control systems is no longer optional. Nation-state actors, ransomware operators, and advanced persistent threat groups are deliberately targeting OT environments, exploiting the IT/OT boundary, abusing remote access pathways, and dwelling undetected for weeks before triggering operational impact. Standard IT hunting toolchains do not parse Modbus, understand DNP3 session behavior, or correlate PLC logic changes with network anomalies. Purpose-built and adapted tooling is essential.
The 30 top-rated ICS security tools for threat hunting in this guide are grouped by operational function: visibility and asset discovery, network and traffic analysis, IDS and protocol-aware detection, threat intelligence, SIEM and analytics, forensics, deception, endpoint integrity, orchestration, and external reconnaissance. Each entry includes a 0–14 day quick-win pilot and a 30–90 day scale plan, both designed to respect process safety and operational constraints.
- Nozomi Networks, Passive OT visibility and asset classification with behavioral baselining.
- Claroty, Passive asset discovery with risk scoring and protocol-aware anomaly detection.
- Dragos Platform, ICS-specific threat behavior analytics and asset baseline with sector-relevant threat groups.
- Radiflow, Flow analysis and anomaly detection tailored for ICS topologies.
- ntopng / NetFlow collectors, Flow-based lateral movement hunting across OT segments.
- Wireshark with ICS dissectors, Deep packet inspection for Modbus, IEC 61850, and DNP3 traffic.
- Tenable.OT, OT-aware vulnerability identification and continuous device risk monitoring.
- Suricata with ICS rule sets, Passive or inline IDS tuned for industrial protocol anomalies.
- Snort with ICS signatures, Signature-based IDS detection for known OT attack patterns.
- MISP, Structured threat intelligence sharing and IOC operationalization for OT-relevant feeds.
- OT-ISAC / Commercial TI feeds, Sector-specific ICS threat indicators and advisory enrichment.
- Splunk Enterprise Security with OT add-ons, Centralized log correlation and OT-specific analytics.
- Elastic Stack (ELK + Beats) , Flexible OT telemetry ingestion and hunt query platform.
- IBM QRadar, Event correlation and OT use-case detection across unified security telemetry.
- Zeek with ICS scripts, Session-level protocol logging and behavioral baseline for OT traffic.
- TShark + PCAP toolchain, Scripted, long-term packet capture and pipeline automation.
- Volatility, Memory forensics for engineering workstations and SCADA hosts under investigation.
- Conpot, Industrial honeypot simulating PLC/HMI surfaces to detect reconnaissance activity.
- Canary Tokens / Thinkst Canary, Lightweight deception tokens and decoy assets detecting unauthorized access.
- Honeyd / custom ICS honeypots, Protocol-specific deception environments for targeted attacker profiling.
- SCADAfence, Host-level integrity monitoring for PLC and RTU configuration state.
- EDR adapted for OT environments, Host telemetry collection on engineering workstations and HMI servers.
- File and config integrity tools, Detection of unauthorized changes to PLC logic and SCADA configurations.
- Cortex XSOAR, Automated hunting playbook orchestration and evidence collection across IT/OT toolchain.
- Swimlane / Siemplify, Case management and workflow automation for OT triage and escalation.
- Shodan / Censys, External exposure monitoring and internet-facing OT asset reconnaissance.
- Nmap with ICS NSE scripts, Safe, targeted network discovery in isolated lab and enclave environments.
- Industrial protocol-aware firewalls and gateways, Policy enforcement and microsegmentation verification across OT zones.
- Segmentation verification tools, Automated validation that microsegmentation policies operate as designed.
- Immutable logging / WORM collectors, Tamper-proof forensic evidence retention for OT incident investigations.
Visibility and Asset Discovery
A hunt program built on an incomplete asset inventory is guessing. These three platforms provide the authoritative baseline every subsequent hunting activity depends on, all through passive, non-intrusive collection.
1. Nozomi Networks, Passive OT Visibility at Scale
Nozomi Networks delivers passive OT asset discovery and behavioral baselining across complex multi-protocol environments.
Example: A mid-size energy utility deployed Nozomi on SPAN ports across four substations and discovered 23% more assets than their CMDB reflected within the first two weeks [example].
Quick win (0–14 days): Deploy passive sensor on a SPAN port covering the highest-risk control segment; review the auto-generated asset inventory against existing records. Scale (30–90 days): Integrate asset and alert telemetry with SIEM; activate behavioral anomaly alerting with operations SME tuning.
KPI: Percentage of OT assets profiled with firmware and protocol classification. Guardrail: Passive only on production segments, no active queries to PLCs without vendor and safety-owner approval.
2. Claroty, Asset Discovery with Risk Prioritization
Claroty combines passive discovery with risk-scored asset profiles, helping hunters prioritize which devices warrant immediate investigation.
Quick win (0–14 days): Import existing asset register; compare discovered devices against the register to identify unknown or shadow assets. Scale (30–90 days): Activate risk-scoring workflows and integrate findings with the vulnerability management program.
KPI: Number of previously unknown assets identified; risk-scored asset coverage percentage. Guardrail: Validate SPAN port configuration does not introduce latency on the production switch before enabling.
3. Dragos Platform, ICS Threat Behavior Analytics
Dragos provides sector-informed behavioral analytics and maps observed activity to known ICS threat groups, giving hunters hypothesis-driven starting points rather than raw alert lists.
Example: Dragos customers in the manufacturing sector have used activity group mapping to identify early-stage reconnaissance behavior consistent with known adversary TTPs [example].
Quick win (0–14 days): Deploy passive sensor and review the auto-generated threat behavior alerts against current network baselines. Scale (30–90 days): Activate threat group playbooks aligned to your sector; integrate with SIEM for cross-platform correlation.
KPI: Number of threat behavior detections mapped to known ICS adversary techniques per quarter. Guardrail: Involve OT engineering in alert validation, avoid automated response actions without human review in OT environments.
Network and Traffic Analysis
Flow analysis and deep packet inspection reveal lateral movement, protocol abuse, and command injection that asset discovery tools cannot surface alone.
4. Radiflow, ICS Flow Analysis and Anomaly Detection
Radiflow maps ICS communication flows and detects deviations from approved operational baselines, particularly effective in complex multi-vendor OT environments.
Quick win (0–14 days): Begin flow collection on the primary control VLAN; document current communication pairs. Scale (30–90 days): Define approved flow policies; configure alerts for flows deviating from the approved baseline.
KPI: Percentage of ICS communication flows covered by approved-flow policy. Guardrail: Establish the flow baseline before enabling anomaly alerts to minimize false positives during the learning phase.
5. ntopng / NetFlow Collectors, Lateral Movement Hunting
ntopng provides flow-level traffic analysis enabling hunters to identify lateral movement patterns and unexpected device-to-device communications across OT segments.
Quick win (0–14 days): Configure flow export from OT core switches to ntopng; identify top talkers and unexpected cross-zone flows immediately. Scale (30–90 days): Build automated alerts for new flow pairs that were not present during the baseline period.
KPI: Number of unauthorized cross-zone flows identified per month. Guardrail: Flow metadata collection is passive, no active probing of live devices.
6. Wireshark with ICS Dissectors, Deep Packet Analysis
Wireshark with industrial protocol dissectors enables hunters to decode and inspect Modbus, IEC 61850, and DNP3 traffic at the function-code level.
Quick win (0–14 days): Capture a 4-hour PCAP from a SPAN port on the primary control VLAN; review for anomalous function codes or unexpected device queries. Scale (30–90 days): Build protocol-specific hunt queries filtering for high-risk function codes; automate PCAP collection pipelines with TShark.
KPI: Number of anomalous function code events identified per hunt session. Guardrail: Store PCAPs in WORM storage immediately on capture; apply access controls to forensic evidence files.
IDS / Protocol-Aware Detection
These tools move from passive observation to active detection, identifying known attack patterns and protocol violations in real time.
7. Tenable.OT, OT Vulnerability and Device Risk Monitoring
Tenable.OT (formerly Indegy) provides continuous device risk monitoring, configuration change detection, and OT-aware vulnerability identification.
Quick win (0–14 days): Deploy passive collection and generate an initial vulnerability risk report for the 20 highest-criticality devices. Scale (30–90 days): Integrate Tenable.OT findings with the vulnerability management workflow; configure change detection alerts for PLC logic modifications.
KPI: Percentage of critical devices with current vulnerability risk assessment; number of unauthorized configuration changes detected. Guardrail: Active queries in Tenable.OT must be validated against device type and vendor guidance before enabling, some legacy devices do not tolerate active polling.
8. Suricata with ICS Rule Sets, Protocol-Aware IDS
Suricata deployed in passive IDS mode with industrial protocol rule sets detects Modbus abuse, DNP3 anomalies, and OPC-UA exploitation attempts without touching live devices.
Quick win (0–14 days): Deploy Suricata in passive mode on a SPAN port; import available ICS rule sets (e.g., Emerging Threats ICS rules). Scale (30–90 days): Tune rule sensitivity with control engineering input; integrate alerts with SIEM for cross-correlation.
KPI: False positive rate per week (target: below 5 actionable alerts per monitored segment after tuning). Guardrail: Never deploy Suricata in inline blocking mode on production OT segments without extensive lab validation and plant safety owner approval.
9. Snort with ICS Signatures, Signature-Based Detection
Snort’s mature signature engine, augmented with ICS-specific rules, provides a well-understood detection baseline for teams with existing Snort operational expertise.
Quick win (0–14 days): Enable passive mode on a SPAN port; activate ICS signature sets and review initial alert volume. Scale (30–90 days): Suppress high-volume, low-confidence signatures; build custom rules for site-specific protocol patterns.
KPI: Signature coverage percentage across monitored ICS protocols. Guardrail: ICS signature quality varies significantly, validate rules in a lab environment before production deployment.
Threat Intelligence and Enrichment
Intelligence without operationalization is noise. These platforms close the gap between raw IOC feeds and actionable hunting hypotheses.
10. MISP, Structured Threat Intelligence Sharing
MISP enables structured collection, enrichment, and sharing of ICS-relevant threat indicators, with sector-specific feeds from ICS-CERT, WaterISAC, and E-ISAC.
Quick win (0–14 days): Stand up a MISP instance; subscribe to at least two ICS-relevant threat feeds and import current IOCs. Scale (30–90 days): Connect MISP to SIEM and SOAR for automated IOC enrichment on incoming alerts.
KPI: Number of actionable OT-relevant IOCs operationalized per month. Guardrail: Validate IOC quality before automated blocking, low-confidence indicators in OT environments can create false operational impacts.
11. OT-ISAC / Commercial TI Feeds, Sector-Specific Intelligence
Sector-specific ISAC feeds (E-ISAC for energy, WaterISAC, MS-ISAC) deliver timely, sector-contextualized threat indicators unavailable in generic commercial feeds.
Quick win (0–14 days): Register for your sector ISAC and subscribe to the advisory and IOC feeds. Scale (30–90 days): Integrate ISAC feeds into MISP or SIEM for automated enrichment and correlation.
KPI: Percentage of active hunting hypotheses informed by sector-specific intelligence. Guardrail: Apply TLP handling requirements to all shared intelligence, manage distribution according to ISAC membership agreements.
SIEM and Analytics for OT Telemetry
Centralizing OT telemetry alongside IT data enables the correlation hunting demands, but requires OT-specific parsers and validated data quality.
12. Splunk Enterprise Security with OT Add-Ons , Central OT Analytics
Splunk’s OT-specific add-ons normalize and correlate ICS telemetry with IT security data, enabling cross-domain hunt queries and alert correlation.
Quick win (0–14 days): Deploy the Splunk OT add-on; ingest OT monitoring platform alerts and validate field normalization. Scale (30–90 days): Build OT-specific hunt dashboards; automate alert correlation between ICS anomalies and Active Directory or VPN access events.
KPI: Time-to-detect (MTTD) for OT-correlated alerts; percentage of ICS alert types with active SIEM correlation rules. Guardrail: OT data ingestion volumes can be large, size license and storage capacity before enabling full PCAP ingestion.
13. Elastic Stack (ELK + Beats), Flexible Hunt Query Platform
Elastic Stack provides a cost-flexible telemetry ingestion and hunt query environment particularly suited to teams building custom OT detection logic.
Quick win (0–14 days): Configure Filebeat or a custom Beat to ingest OT monitoring platform logs; validate field mapping. Scale (30–90 days): Build KQL-based hunt queries for lateral movement indicators; integrate with OT asset inventory for enriched alert context.
KPI: Number of active OT hunt queries producing reviewed results per month. Guardrail: Apply index lifecycle management, unbounded OT telemetry ingestion without retention policies creates storage and licensing risk.
14. IBM QRadar , Correlation and OT Use Cases
QRadar’s correlation engine, paired with OT-specific use case packages, provides mature event correlation for security teams with existing QRadar investments.
Quick win (0–14 days): Install available OT use case packages; ingest OT monitoring platform syslog events. Scale (30–90 days): Build cross-domain correlation rules linking ICS anomalies with IT authentication and remote access events.
KPI: Cross-domain correlated events per month; false positive rate on OT-specific rules. Guardrail: Validate OT use case packages against your specific protocol environment before enabling automated offense creation.
Forensics and Packet Capture
When a suspected incident requires investigation, these tools provide the evidence collection and analysis capability that determines whether a hunt becomes an incident response.
15. Zeek with ICS Scripts, Session-Level Protocol Logging
Zeek generates structured session logs for OT protocols, providing hunters with queryable behavioral records rather than raw packet captures.
Quick win (0–14 days): Deploy Zeek with available ICS scripts on a SPAN port; verify Modbus and DNP3 session logs are being generated. Scale (30–90 days): Feed Zeek logs to SIEM; build hunt queries over historical session data for retrospective analysis.
KPI: OT protocol session log coverage percentage; retrospective hunt query response time. Guardrail: Store Zeek logs in WORM storage with access controls, session logs are forensic evidence in an incident.
16. TShark + PCAP Toolchain, Scripted Capture Pipelines
TShark enables automated, long-term PCAP collection with protocol-specific filters, essential for forensic reconstruction of slow, low-and-slow attack campaigns.
Quick win (0–14 days): Configure a TShark capture on a critical SPAN port with rotating PCAP files; verify capture is running and files are accessible. Scale (30–90 days): Build filter scripts for specific protocol anomaly patterns; automate PCAP retention and offsite backup.
KPI: PCAP retention coverage in days; successful forensic reconstructions from archived captures. Guardrail: Capture storage can grow rapidly , define and enforce retention policies and capacity alerts before enabling.
17. Volatility, Memory Forensics for OT Hosts
Volatility enables memory image analysis of compromised engineering workstations and SCADA servers, revealing in-memory malware, injected code, and credential material that disk forensics misses.
Quick win (0–14 days): Acquire a memory image from a non-production engineering workstation replica; validate Volatility profile compatibility. Scale (30–90 days): Develop memory forensics procedures for the three most likely OT incident scenarios; train IR team on OT-specific memory artifacts.
KPI: Memory forensics capability validated for all critical SCADA host OS versions in the environment. Guardrail: Memory acquisition from live production SCADA hosts requires operations sign-off, the acquisition process itself can impact host performance.
Deception and Honeypots
Deception assets require no baseline, generate no false positives, and produce high-confidence alerts, any interaction with a well-placed honeypot is by definition anomalous.
18. Conpot, Industrial Honeypot for Reconnaissance Detection
Conpot simulates PLC and HMI surfaces across multiple industrial protocols, attracting and profiling attackers conducting internal reconnaissance.
Quick win (0–14 days): Deploy a Conpot instance on an unused IP in the OT VLAN; configure logging to SIEM. Scale (30–90 days): Add multiple Conpot instances across different zones; build automated alerts for any connection attempt.
KPI: Number of attacker interactions per month; unique source IPs observed interacting with decoys. Guardrail: Ensure Conpot is clearly isolated from real controllers, no shared credentials or network paths that could cause attacker pivot.
19. Canary Tokens / Thinkst Canary, Lightweight Deception Assets
Canary Tokens and Thinkst Canary devices provide high-fidelity detection through decoy files, credentials, and devices that alert immediately on any access.
Quick win (0–14 days): Deploy credential canary tokens in engineering workstation shares; configure immediate alert on token access. Scale (30–90 days): Place Canary devices on control VLAN segments to simulate HMI and historian surfaces.
KPI: Zero false positives (any alert is a true positive by design); mean time from token trigger to hunter awareness. Guardrail: Label canary assets in the asset inventory so operations staff do not interact with them inadvertently, coordinate placement with plant operations.
20. Honeyd / Custom ICS Honeypots, Protocol-Specific Deception
Custom honeypots built on Honeyd can simulate site-specific ICS services, enabling highly tailored deception matched to the attacker’s expected target environment.
Quick win (0–14 days): Deploy a simple Honeyd instance simulating a Modbus-accessible device; configure connection logging. Scale (30–90 days): Build protocol-response fidelity for the specific device types in your environment; integrate alerts with SOAR for automated case creation.
KPI: Honeypot interaction detection rate for simulated reconnaissance activity. Guardrail: Custom honeypot development requires control engineering review to ensure simulated responses do not inadvertently affect process understanding or operator behavior.
Endpoint and Host Integrity Monitoring
Engineering workstations and HMI servers are the most common attacker pivot points in OT intrusions. Host-level visibility on these assets is critical.
21. SCADAfence, Host Integrity for PLC/RTU Environments
SCADAfence provides configuration state monitoring for PLCs and RTUs, detecting logic changes and unauthorized configuration modifications.
Quick win (0–14 days): Baseline current PLC and RTU configurations; configure alerts for any configuration change event. Scale (30–90 days): Integrate configuration change alerts with change management workflow; require approved change ticket for every detected modification.
KPI: Percentage of critical PLCs and RTUs with configuration baseline; unauthorized change detection rate. Guardrail: Validate monitoring scope with control engineers , some devices do not support external configuration polling without operational impact.
22. EDR Adapted for OT Environments, Host Telemetry Collection
Hardened EDR agents on engineering workstations and HMI servers provide process-level telemetry detecting malware execution, lateral movement tools, and credential harvesting.
Quick win (0–14 days): Deploy EDR in audit/monitoring mode on one non-critical engineering workstation; review baseline telemetry. Scale (30–90 days): Extend to all engineering workstations and HMI servers; integrate telemetry with SIEM.
KPI: Percentage of OT host endpoints with active host telemetry collection. Guardrail: Never deploy EDR with automated response capabilities on OT hosts without extensive lab validation, automated process termination on a SCADA host is an operational emergency.
23. File and Configuration Integrity Tools, Detect Unauthorized Logic Changes
File integrity monitoring on SCADA server directories and PLC configuration backups detects unauthorized modifications to control logic and application files.
Quick win (0–14 days): Implement file integrity monitoring on engineering workstation program directories; establish known-good hash baselines. Scale (30–90 days): Automate integrity checks on scheduled backup cycle; alert on any hash deviation from the approved baseline.
KPI: Hash verification coverage for PLC logic files and SCADA application directories. Guardrail: Maintain an approved change log, integrity alerts without change management context produce unactionable noise.
SOAR and Orchestration
Orchestration tools transform individual tool alerts into coordinated hunting workflows , reducing analyst time-to-triage and ensuring consistent evidence collection.
24. Cortex XSOAR, OT Hunt Playbook Orchestration
Cortex XSOAR automates hunting playbook execution, evidence collection, and cross-tool correlation across IT and OT toolchains.
Quick win (0–14 days): Build one OT-specific playbook automating alert triage for ICS anomaly events; connect to SIEM and OT monitoring platform. Scale (30–90 days): Develop playbooks for the top five OT incident scenarios; integrate with ticketing and evidence management systems.
KPI: Mean time from OT alert to analyst triage (target: reduce by 50% post-orchestration). Guardrail: Automated response actions in XSOAR playbooks must require human approval before any OT network or device action is executed.
25. Swimlane / Simplify, OT Case Management and Workflow Automation
Swimlane and Siemplify provide structured case management and low-code workflow automation for OT triage, reducing manual analyst steps in high-alert-volume environments.
Quick win (0–14 days): Integrate SIEM OT alerts into Swimlane/Siemplify; build a basic triage workflow routing OT alert to the correct analyst queue. Scale (30–90 days): Automate evidence capture steps for common OT alert types; build escalation workflows for safety-critical events.
KPI: Analyst time per OT case (target: measurable reduction within 60 days of deployment). Guardrail: Workflow automation must include mandatory human gates before any remediation action affecting production OT systems.
Reconnaissance and External Monitoring
External exposure reconnaissance is a legitimate and non-intrusive starting point for any hunt program, and often reveals attack surface the internal team does not know exists.
26. Shodan / Censys, External Exposure Monitoring
Shodan and Censys enable hunters to identify internet-facing OT assets, exposed management interfaces, and misconfigured industrial services from the attacker’s perspective.
Quick win (0–14 days): Run a Shodan/Censys query for your organization’s IP ranges; identify any internet-facing OT or management services. Scale (30–90 days): Configure continuous monitoring alerts for new findings; integrate discovered exposure risks with vulnerability management.
KPI: Number of internet-exposed OT services identified and remediated; external exposure surface reduction month-over-month. Guardrail: Shodan and Censys queries are passive and read-only, use only for reconnaissance of your own infrastructure; unauthorized reconnaissance of third-party systems creates legal exposure.
27. Nmap with ICS NSE Scripts, Targeted Lab Discovery
Nmap with ICS-specific NSE scripts enables targeted network discovery and service enumeration in isolated lab and enclave environments.
Quick win (0–14 days): Run Nmap with ICS scripts against the lab/replica environment; validate discovered services against expected topology. Scale (30–90 days): Build scheduled enclave discovery scans for isolated test environments; use findings to validate segmentation effectiveness.
KPI: Segmentation gap discoveries per scan cycle in lab environments. Guardrail: Never run Nmap against live production OT segments without explicit vendor approval, plant safety owner sign-off, and a tested rollback plan. Active scanning of legacy PLCs can cause device hangs or resets.
Specialized OT Controls and Protection
28. Industrial Protocol-Aware Firewalls and Gateways, Policy Enforcement
Protocol-aware industrial firewalls enforce function-code whitelisting, connection policies, and microsegmentation , and provide hunters with policy violation telemetry.
Quick win (0–14 days): Review current firewall rule sets for any OT segments; identify any allow-all rules that should be replaced with protocol-specific policy. Scale (30–90 days): Implement function-code filtering for Modbus and DNP3 on highest-risk zone boundaries; integrate violation logs with SIEM.
KPI: Percentage of ICS inter-zone flows subject to protocol-level policy enforcement. Guardrail: Test all firewall policy changes in a lab replica before production deployment , a misconfigured rule on a safety system boundary is a safety event, not just a security event.
29. Segmentation Verification Tools, Confirm Microsegmentation Effectiveness
Dedicated segmentation testing tools validate that network segmentation policies operate as designed, confirming that assumed isolation is real isolation.
Quick win (0–14 days): Run a segmentation verification scan against lab/enclave environments; document any unexpected paths between zones. Scale (30–90 days): Build scheduled segmentation verification into the security testing calendar; integrate findings with remediation tracking.
KPI: Number of unintended cross-zone paths identified and remediated per quarter. Guardrail: Segmentation testing on production environments requires plant operations approval and a defined rollback procedure, schedule during maintenance windows.
30. Immutable Logging / WORM Collectors, Tamper-Proof Evidence Storage
WORM and append-only log storage ensures that forensic evidence from OT incidents remains admissible, complete, and unaltered through the investigation and recovery process.
Quick win (0–14 days): Configure all OT monitoring and SIEM platforms to export logs to a write-once storage target; verify retention period meets incident investigation requirements. Scale (30–90 days): Implement chain-of-custody procedures for forensic evidence; conduct a tabletop exercise using archived logs to validate forensic reconstruction capability.
KPI: Log retention coverage in days; successful forensic reconstruction tests per year. Guardrail: Access to immutable log stores must be strictly controlled, read access for investigation; no write or delete access for any operational role.
Conclusion
Effective ICS threat hunting starts with visibility and ends with evidence-backed detection. The sequencing matters: build complete asset inventory first, establish behavioral baselines second, develop hunting hypotheses from threat intelligence third, layer detection tooling on top of a known-good baseline fourth, and integrate response orchestration only after the human process is validated.
Every tool in this catalogue should complete a lab-validated pilot before production deployment. Measure MTTD, asset coverage, and false positive rate at each stage. Do not scale tools that cannot demonstrate measurable improvement against pre-defined KPIs.
Safety is non-negotiable throughout. Every pilot, every scan, and every configuration change requires operations sign-off. The threat hunter’s job is to find adversaries, not to create incidents of their own.