Threat video1:00
CI Fortify OT Isolation and Recovery: Analysis & Hunting
CI Fortify tells operators to cut OT off from business networks and recover systems. 9 detection rules, 8 ATT&CK techniques, plus a free Splunk SPL rule.
Read the full threat intel for CI Fortify OT Isolation and Recovery: Analysis & Hunting →
Chapters
- 0:00The hookCISA urges OT disconnection and recovery.
- 0:04The storyNation-state actors target critical OT.
- 0:12Attack pathThreat actors enter via trusted connections and remote access.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise3 indicators to hunt: 3 documents.
- 0:38MITRE ATT&CK techniques8 ATT&CK techniques, from initial access to impact.
- 0:43Remediation4 steps now: Identify critical customers and set service delivery targets.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00CISA urges OT disconnection and recovery.
0:05Nation-state actors target critical OT.
0:08Disconnected systems survive weeks isolated.
0:12Threat actors enter via trusted connections and remote access.
0:17Stolen credentials enable access to operational systems.
0:21Isolated OT blocks entry for weeks of operation.
0:27No threat actor is attributed. Confidence: low.
0:323 indicators to hunt: 3 documents.
0:388 ATT&CK techniques, from initial access to impact.
0:434 steps now: Identify critical customers and set service delivery targets.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.