Welcome back to the cybersecurity desk. As an editor mapping the convergence of enterprise IT, operational technology (OT), and the Industrial Internet of Things (IIoT), I see a recurring blind spot in modern incident response. When a corporate network is breached, security teams hunt for traditional IT Indicators of Compromise (IOCs)-such as anomalous PowerShell commands, unusual outbound data exfiltration to foreign IP addresses, or registry key modifications.
However, applying this same playbook to the factory floor or power substation is a fast track to disaster. Industrial environments do not run on standard user habits; they operate on rigid, deterministic logic, predictable communication cycles, and proprietary protocols like Modbus, DNP3, and PROFINET. Recent threat data underscores this vulnerability: ransomware and targeted cyber attacks against industrial organizations surged dramatically, with threat intelligence groups tracking thousands of impacted entities globally. Yet, an alarming percentage of industrial networks still lack basic internal visibility below the IT/OT boundary.
When an attacker pivots from IT into OT, they leave physical and protocol-level footprints that look entirely different from corporate cyber attacks. To catch intrusions before they translate into physical destruction or safety system failures, your Security Operations Center (SOC) must look for the right signals. Here are the top 15 Indicators of Compromise tailored specifically for operational technology environments.
Top 15 Indicators of Compromise (IOCs) in OT
1. Unexpected PLC Mode Transitions (Run-to-Program Mode)
A Programmable Logic Controller (PLC) or RTU unexpectedly switches its operational state from “Run” mode to “Program” or “Remote” mode without an authorized, scheduled maintenance window. PLCs only execute deterministic control logic when locked in Run mode. Forcing a controller into Program mode halts process execution entirely, allowing an attacker to overwrite ladder logic, modify control registers, or inject malicious firmware payloads directly into the runtime memory.
2. Unauthorized Firmware Checksum Mismatches
A baseline integrity check reveals a cryptographic hash discrepancy between the running firmware image on a field controller or IIoT gateway and the manufacturer’s verified golden image. Sophisticated threat actors targeting industrial assets increasingly utilize low-level binary tampering and custom bootloaders. A checksum mismatch is a smoking gun indicating that firmware has been quietly modified to create a persistent backdoor or alter physical process logic.
3. Anomalous Register Setpoint Modifications Outside Normal Operating Envelopes
Telemetry logs show critical process variables-such as pressure thresholds, valve opening percentages, or chemical dosing rates-being adjusted to out-of-bounds parameters outside of normal operational tolerances. Attackers seeking physical disruption do not need to deploy complex malware if they can manipulate control loop variables. Unauthorized register writes directly target the physical safety margins of industrial machinery, risking catastrophic thermal runaway or equipment rupture.
4. Proprietary Protocol Command Anomalies (e.g., Illegal Function Codes)
Industrial Deep Packet Inspection (DPI) tools flag rare or vendor-unsupported function codes embedded within protocols like Modbus TCP (e.g., diagnostic or programming function codes sent to a field device that only accepts read/write commands). Industrial protocols lack native authentication. Threat actors leverage vendor-specific or diagnostic function codes to execute privileged engineering tasks remotely, bypassing standard HMI controls to interact directly with the controller’s memory stack.
5. Unscheduled Engineering Workstation Software Execution
Engineering software suites (such as Siemens TIA Portal, Rockwell Studio 5000, or Schneider EcoStruxure) initiate active sessions or project file transfers outside of verified change-management windows. Engineering workstations are the holy grail for OT attackers. Because these machines hold the master project files required to push compiled logic down to PLCs, unexpected execution of engineering tools usually indicates that an adversary has successfully pivoted from the IT domain and is preparing to deploy a logic-altering payload.
6. Unauthorized Dual-Homed Network Connections
Network monitoring reveals a previously undocumented active interface bridging the enterprise IT network directly with the Level 2 control network, or a historian server maintaining active links to both domains simultaneously. Dual-homed devices completely bypass the security benefits of an industrial Demilitarized Zone (IDMZ). Attackers actively search for these architectural shortcuts to establish a direct, unhindered bridge from compromised corporate email servers straight onto the plant floor.
7. Unexplained Changes to Human-Machine Interface (HMI) Screens
Visual elements, alarm thresholds, or manual override buttons on an operator’s HMI dashboard are subtly altered, hidden, or desynchronized from actual field sensor readings. Classic cyber-physical attacks rely on operator deception. By modifying HMI screens, attackers can blind operators to real-time process failures, causing them to override safety interlocks or ignore critical pressure spikes while malicious scripts manipulate the physical process behind the scenes.
8. Unauthorized Direct PLC-to-PLC Communications (Lateral East-West Traffic)
Field controllers (Level 1) begin exchanging direct, unmediated network packets with one another across different production cells, violating the strict hierarchical Purdue Model traffic flow. Under normal plant architectures, PLCs communicate primarily with supervisory SCADA servers or HMIs (North-South traffic). When controllers start talking directly to each other laterally, it often signals automated worm propagation or lateral malware movement scanning the subnet for vulnerable sibling devices.
9. High-Frequency Polling and Reconnaissance Sweeps on Serial/Ethernet Gateways
A massive, rapid spike in Read/Write polling requests directed at serial-to-ethernet converters or industrial protocol gateways from an internal IP address. When an adversary lands on an unfamiliar OT network, they must map the physical topology by querying device registers. High-frequency enumeration sweeps are a distinct behavioral footprint of automated discovery tools probing for responsive field nodes.
10. Modification or Deletion of Local Controller Audit and Event Logs
Sudden gaps in event history, cleared security logs, or disabled diagnostic auditing functions on smart switches, firewalls, or intelligent electronic devices (IEDs). Professional threat actors understand that digital forensics will expose their footprint. Purging or disabling system logs is a classic tradecraft indicator deployed immediately before or after executing a destructive operational command to cover their tracks.
11. Unexpected Stop/Start Commands Issued to Safety Instrumented Systems (SIS)
Telemetry logs record configuration changes, test overrides, or state shifts directed at safety-critical controllers independent of the basic process control network. Safety Instrumented Systems are the absolute last line of defense against physical catastrophes. Any unauthorized interaction with an SIS-especially attempts to disable safety functions or alter trip limits-indicates an advanced attacker intentionally stripping away the facility’s life-safety protections.
12. Unauthorized ARP Table Poisoning or MAC Spoofing on Industrial Switches
Network monitoring tools log frequent Address Resolution Protocol (ARP) anomalies, duplicate IP assignments, or sudden MAC address flapping on industrial Ethernet switches. Attackers use ARP spoofing on unencrypted industrial networks to execute Man-in-the-Middle (MitM) attacks, intercepting telemetry packets traveling between field sensors and control rooms to falsify readings or capture administrative credentials.
13. Anomalous Outbound Data Beacons from Isolated OT Subnets
A low-footprint, periodic outbound connection initiated from a static OT asset (such as a historian or engineering station) toward an unverified external IP address during off-peak operational hours. Air-gapped networks are rarely 100% isolated in practice. Persistent outbound beacons indicate an active Command-and-Control (C2) heartbeat, tunneling telemetry out of the plant floor or checking in for staging instructions from external operators.
14. Configuration File Drift Across Identical Controller Fleets
Automated configuration management tools detect subtle, unauthorized parameter drift across a cluster of identical controllers deployed across multiple production lines. In automated manufacturing, identical machines usually run identical, hashed configuration files. Unexplained drift in register settings or communication timeouts across a fleet points toward targeted, incremental staging of malicious logic parameters.
15. Unrecognized Dynamic Link Library (DLL) or Driver Injection on SCADA Servers
Endpoint detection tools flag the loading of unsigned, unverified DLLs or kernel-level drivers into the memory space of Windows-based SCADA servers or historical data collectors. SCADA servers run critical supervisory software that interacts directly with plant hardware. Injecting malicious code into these servers allows attackers to execute “living off the land” techniques, hijacking legitimate industrial software processes to issue rogue commands down to the floor.
Conclusion
Detecting compromises in operational technology requires moving far beyond the traditional IT mindset of looking for stolen credit cards or encrypted user files. In the industrial ecosystem, an indicator of compromise is often a subtle shift in timing, a forbidden function code, or an unauthorized mode transition on a PLC. By training your security operations center to recognize these 15 critical OT-specific IOCs-and integrating passive protocol-aware monitoring across your industrial network-you can intercept threat actors during their reconnaissance and lateral movement phases, protecting your plant floor from physical disaster.