Threat video1:00
Iranian-Affiliated PLC Logic Tampering: Detection & IOCs
Iranian-affiliated actors alter PLC logic at US water and energy sites without any CVE. 30 IOCs and 9 detection rules, including a free Splunk SPL query.
Read the full threat intel for Iranian-Affiliated Actors Exploit Internet-Exposed PLCs (Rockwell… →
Chapters
- 0:00The hookIranian-affiliated actors are attacking US infrastructure.
- 0:05The storyNo software vulnerability is required.
- 0:11Attack pathActors target internet-accessible PLCs.
- 0:26AttributionAttributed to Iranian-affiliated actors.
- 0:31Indicators of compromise26 indicators to hunt: 21 IPs, 3 domains and 2 SHA-1 hashes.
- 0:39MITRE ATT&CK techniques5 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation5 steps now: Remove PLCs from direct internet exposure.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Iranian-affiliated actors are attacking US infrastructure.
0:05No software vulnerability is required.
0:08They mimic an authorized technician.
0:11Actors target internet-accessible PLCs.
0:14Then they reach PLCs with programming software.
0:18Shutdown and alarm logic was disabled.
0:21At some victims, operations were disrupted.
0:26Attributed to Iranian-affiliated actors. Confidence: medium.
0:3126 indicators to hunt: 21 IPs, 3 domains and 2 SHA-1 hashes.
0:395 ATT&CK techniques, from reconnaissance to impact.
0:445 steps now: Remove PLCs from direct internet exposure.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.