Threat Hunt Plan: Iran-Affiliated Targeting of Critical Infrastructure PLCs — Rockwell, Schneider, and Siemens OT Exploitation

Revision 2.2 — 2026-07-23 (aligned to AA26-097A as updated July 22, 2026, incl. the 21-indicator STIX set)

Hunt Objective and Scope

This hunt seeks evidence of Iran-affiliated APT activity against internet-exposed operational technology, as described in joint Cybersecurity Advisory AA26-097A (originally April 7, 2026; updated July 22, 2026). The adversary reaches internet-facing PLCs from overseas leased infrastructure and connects using the vendors' own legitimate engineering software, then extracts the device project file, manipulates ladder logic and reusable code modules, and alters data on HMI and SCADA displays. The July 22 update broadened the confirmed manufacturer scope beyond Rockwell Automation/Allen-Bradley (CompactLogix, Micro850, via Studio 5000 Logix Designer) to include Schneider Electric (Modicon M340 / BMX P34, via EcoStruxure Control Expert) and Siemens (S7-1200, via TIA Portal), added exfiltration of project files (T1041), reported malicious Rockwell Add-On Instructions that disabled alarm and shutdown logic at a victim site, and expanded the machine-readable indicator set from eight to twenty-one IP addresses. The actors also deploy Dropbear SSH on victim endpoints for remote access over port 22 and target OT ports 44818, 2222, 102, and 502.

In scope: internet-facing and DMZ-adjacent OT devices (Rockwell, Schneider, Siemens, and other Modbus-capable controllers) and their upstream engineering workstations (EWS), HMIs, historians, and jump hosts; the Purdue Level 3/3.5 boundary; cellular-modem-connected field devices (pump stations, substations, remote municipal sites — the dominant exposure population); and any Windows/Linux host that runs PLC configuration software or terminates remote access into the OT network. The hunt covers network telemetry (NetFlow, firewall, PCAP), endpoint telemetry (CrowdStrike Falcon, Windows Event Logs), OT monitoring platform data (Dragos, Claroty CTD, Nozomi, Tenable OT, Forescout, Armis), and external attack-surface OSINT (Shodan, Censys).

Out of scope: enterprise IT assets with no path to the OT network. Time window: baseline the trailing 12 months where telemetry retention allows (earliest published IOC association is November 2025; confirmed compromises since at least March 2026); prioritize the trailing 90 days for active-compromise triage. All queries are read-only; no active probing of controllers is performed. All hostnames, boundary names, IP ranges, ASNs, notification handles, and rule paths in this plan are generic placeholders — substitute the tenant-specific values before execution. In particular, the 203.0.113.0/24 range, AS64500, and "Your Organization" used in the Hypothesis 5 Shodan/Censys queries are RFC 5737 documentation values shown for demonstration only.

Hypotheses and Hunt Procedures

Hypothesis 1: An Iran-affiliated actor has connected to an internet-exposed Rockwell, Schneider, or Siemens PLC from external infrastructure using engineering software, observable as inbound/outbound sessions on OT ports (44818, 2222, 102, 502) crossing the internet boundary, engineering-tool process execution on non-baseline hosts, and project-file exfiltration.

MITRE ATT&CK: Initial Access | T0883 — Internet Accessible Device | The actor accesses publicly exposed, internet-reachable PLCs installed without sufficient network hardening.

MITRE ATT&CK: Execution | T0843 — Program Download | Engineering software creates an accepted connection and transfers project/logic to the controller.

MITRE ATT&CK: Exfiltration | T1041 — Exfiltration Over C2 Channel | The actor uses vendor configuration software on leased infrastructure to steal controller project files.

Collection Queries

CrowdStrike Falcon LogScale (CQL) — multi-vendor engineering-software execution (rarity-sorted; a Logix/RSLinx, Control Expert/Unity, or TIA Portal process on a host that is not a sanctioned EWS is the signal):

CrowdStrike Falcon LogScale (CQL) — Windows-host connections on OT ports to a non-RFC1918 (external) address:

BPF / tcpdump — rolling capture of OT engineering/control ports at the L3/3.5 boundary tap (strftime rotation, 512 MiB size cap):

Datadog — Logs > Explorer (Windows EWS/HMI engineering-tool launch; OT is typically on-prem, so CloudTrail/VPC-flow sources are not applicable — note this gap and use source:windows):

Datadog — Infrastructure > Processes (Live Process Monitoring; fallback for hosts without Sysmon forwarding):

Windows Event IDs to collect on EWS/HMI hosts:

OT Data Collection: Dragos Platform — Communications Hub: filter connections crossing the OT/IT boundary or sourced externally on ports 44818/2222/102/502/22; review the EtherNet/IP and S7 QFDs (Query Focused Datasets) for engineering sessions and program up/download from non-EWS talkers; export the matching connection list.

OT Data Collection: Claroty CTD — Communication Analysis: scope to OT baseline; surface Insight/OT-Activity events for controller writes, program downloads, and mode changes; use the CTD PCAP export on flagged conversations (CTD retains PCAP) for offline protocol carving.

OT Data Collection: Nozomi Guardian — N2QL via the OpenAPI query endpoint (GET /api/open/query/do?query=<N2QL>), 10,000 rows/page:

OT Data Collection: Tenable OT — GraphQL only (/graphql; no REST /api/v1/): pull Events for PLC mode changes and project upload/download, and Risks > Findings for CVE-2021-22681 across the Logix fleet; run pyTenable for a fleet-wide firmware-version and code-snapshot histogram across Rockwell, Schneider, and Siemens controllers.

OT Data Collection: Forescout eyeInspect — Command Center: filter alerts on EtherNet/IP CIP writes/ForwardOpen, S7Comm program transfer, and Schneider UMAS writes from non-baseline sources; forward CEF/syslog to the SIEM; run ICS Patrol only with engineering sign-off, never against safety controllers.

OT Data Collection: Armis Centrix (ASQ) — external source reaching OT-protocol ports (default-omit boundary; the OT-port set is the OT-scoping; set the time window in the UI picker):

Analysis Queries

CrowdStrike Falcon LogScale (CQL) — attribute the OT-port connection to its originating process (reverse-direction join: ProcessRollup2 is the streaming main query, the narrow NetworkConnectIP4 filter is the subquery — avoids the 100k subquery cap):

Wireshark / tshark — EtherNet/IP control-plane services from an unexpected source (ForwardOpen, Write Tag, controller Stop/Reset):

Wireshark / tshark — Siemens S7comm program download/upload and CPU stop (port 102 scope):

Datadog — Logs > Analytics (Timeseries + Table, group by destination address to match the CQL groupBy on RemoteAddressIP4):

Datadog Monitor (create via Monitors > New Monitor > Logs; API POST /api/v1/monitor):

Windows Event Log PowerShell analysis — remote-interactive logons into EWS/jump hosts in the window:

OT network and protocol analysis — baseline every talker that issues EtherNet/IP write/control services (0x4d Write Tag, 0x54 ForwardOpen, 0x07 Reset), S7 program transfer (0x1a-0x1f), or Schneider UMAS write functions, and compare against the sanctioned EWS list; any control-class service from a non-EWS or external source is a finding (T0836 / T0843 / T0858 / T0855).

Hypothesis 2: The actor has communicated with OT assets from published Iran-affiliated operator infrastructure, observable as connections to/from the 21 IOC IPs (and the community-identified adjacent operator range) in network, firewall, and endpoint telemetry within the associated time frames.

MITRE ATT&CK: Command and Control | T0885 — Commonly Used Port | The actor used common OT ports to reach controllers from overseas hosting infrastructure.

Collection Queries

CrowdStrike Falcon LogScale (CQL) — any host communicating with the 21 published CISA IOC IPs (July 22, 2026 STIX set):

BPF / tcpdump — targeted capture of the operator IP set (the /24 clusters cover the multi-homed operator subnet plus the July additions):

Datadog — Logs > Explorer (firewall/flow logs where forwarded; explicit gap note: if NetFlow/firewall logs are not forwarded to Datadog, this hypothesis relies on the CQL/OT-platform paths and the perimeter firewall SIEM):

OT Data Collection: Armis Centrix (ASQ) — any connection touching the 21 published IOC IPs:

OT Data Collection: Nozomi Guardian — N2QL match on the operator subnets and singleton hosts via link records:

Analysis Queries

CrowdStrike Falcon LogScale (CQL) — pivot from any IOC-IP hit to the destination-port spread of the implicated host (many distinct OT ports to one operator host = engineering-session signal):

Wireshark / tshark — extract the CIP/S7 conversation content from any operator-host capture to determine what was read or written:

OT network and protocol analysis — Disposition note: the authoring agencies flag the 21 published IPs as historical-association and recommend vetting before blocking; the seven original 185.82.73.x IPs plus the community-identified adjacent IPs (185.82.73.160/.161/.163/.166, and .169 currently dark) resolve to a single multi-homed operator workstation in AS214036 per external scan analysis — treat any hit as an investigative lead, correlate against observed EtherNet/IP/S7 services, and confirm before enforcement.

Hypothesis 3: The actor has deployed Dropbear SSH on a victim endpoint (EWS, gateway, or jump host) to maintain remote access over port 22, observable as a dropbear binary/process, an unexpected port-22 listener, and inbound SSH from external sources.

MITRE ATT&CK: Command and Control | T1219 — Remote Access Software | The actor deployed Dropbear SSH on victim endpoints to gain remote access over port 22.

Collection Queries

CrowdStrike Falcon LogScale (CQL) — Dropbear process execution:

CrowdStrike Falcon LogScale (CQL) — Dropbear binary written to disk (catch-all file-write event; join to ProcessRollup2 for the writing process):

YARA — file-system scan of EWS/jump-host staging directories for Dropbear artifacts:

Windows Event IDs to collect:

Analysis Queries

CrowdStrike Falcon LogScale (CQL) — SSH client/tunnel command patterns (reverse-tunnel / port-forward flags):

YARA — process-memory scan of a suspect PID for in-memory Dropbear strings (classic YARA 4.5, positional PID):

Wireshark / tshark — SSH sessions to/from external hosts on 22 (identify non-standard SSH banners / Dropbear version strings):

Hypothesis 4: The actor has extracted or altered a controller project file and manipulated HMI/SCADA data, observable as reads/writes of vendor project files on EWS, program download/upload on the wire, out-of-baseline changes to reusable code modules (Add-On Instructions), and displayed process values inconsistent with process state — including logic that disables alarm/shutdown functions.

MITRE ATT&CK: Impact | T1565 — Data Manipulation | The actor maliciously interacted with project files and altered data on HMI and SCADA displays.

MITRE ATT&CK: Impair Process Control | T0889 — Modify Program / T0843 — Program Download | Malicious ladder logic and Add-On Instructions replace or amend valid logic, including modules that disabled alarm and shutdown functions.

Collection Queries

CrowdStrike Falcon LogScale (CQL) — vendor project/export file writes across Rockwell (.ACD/.L5X/.L5K), Schneider (.STU/.STA/.SMBP), and Siemens (.ZAP1x/.AP1x) formats, tiered by whether the writer is a sanctioned engineering tool:

BPF / tcpdump — full-payload capture on EtherNet/IP and S7 to carve downloaded/uploaded logic blocks:

OT Data Collection: Tenable OT — GraphQL: pull Code Snapshot diffs for every Rockwell, Schneider, and Siemens controller; any code-revision or Add-On-Instruction change without a matching change ticket is a finding (Tenable catches local-only changes made at the panel that never traversed the wire).

OT Data Collection: Claroty CTD — OT-Activity events for RSLogix/Studio 5000, Control Expert, and TIA Portal program downloads and tag writes; export the flagged sessions with PCAP for logic carving.

OT Data Collection: Dragos Platform — EtherNet/IP and S7 QFDs for program up/download and Write Tag; correlate with the Notifications feed for program-modification detections; pay specific attention to changes affecting alarm/shutdown logic.

Analysis Queries

CrowdStrike Falcon LogScale (CQL) — surface only the CRITICAL tier (project file written by a non-engineering process — e.g., a script interpreter, archiver, or unknown binary):

Wireshark / tshark — reassemble a program-download byte stream to recover injected logic (Rockwell EtherNet/IP and Siemens S7):

YARA — scan carved project/logic files for tamper markers (reusable code-module / Add-On Instruction changes called out in the AA26-097A July 2026 update):

OT network and protocol analysis — compare current controller code snapshots (Tenable OT / Claroty) against the last known-good baseline; diff reusable code modules (Add-On Instructions) specifically, per the advisory update, and confirm alarm/shutdown/interlock logic is intact; any changed rung or AOI without a change ticket is escalated.

Hypothesis 5: One or more of the organization's PLCs, HMIs, or engineering workstations is directly reachable from the public internet, observable via third-party internet-scan datasets (Shodan, Censys) that already index the exposed service — the same attack surface the actor enumerates before connecting.

MITRE ATT&CK: Initial Access | T0883 — Internet Accessible Device | The actor accesses publicly exposed, internet-reachable PLCs; external-scan datasets reveal that exposure before the adversary reaches it.

Scope note (read before running): 203.0.113.0/24, AS64500, and "Your Organization" below are RFC 5737 documentation values used for demonstration ONLY. Replace them with the organization's own registered public IP range(s), ASN(s), and org name before running — these are lookups against your OWN external attack surface, not the actor's infrastructure. Run only against address space your organization owns or is authorized to assess.

Collection Queries

Shodan (web console) — scope every query to the organization's own address space (replace the demonstration 203.0.113.0/24 / AS64500 / org placeholders with your real values); OT control ports and co-exposed remote-access services:

Shodan CLI (repeatable sweep + continuous monitoring; substitute your own netblocks for 203.0.113.0/24):

Censys (web console / Platform) — reproduce your own exposed Rockwell/Siemens/Schneider footprint (replace the demonstration ASN 64500 / 203.0.113.0/24 with your real ASN or IP range):

Censys CLI / API (censys-python; or GET https://search.censys.io/api/v2/hosts/search; substitute your own IP range):

Analysis Queries

Shodan / Censys — operator-infrastructure markers (run GLOBALLY, not scoped to your space; new results indicate the actor is expanding engineering infrastructure and are a leading indicator of renewed activity):

External attack-surface analysis — cross-reference every host returned by the own-scope queries against the sanctioned OT asset inventory. Any PLC, HMI, or engineering workstation reachable from the internet is a finding requiring immediate removal from direct exposure. Specifically escalate: (1) an EtherNet/IP identity response that leaks a Windows hostname in the product_name field (vendor_id 0x004d) — that is RSLinx / FactoryTalk Linx on an internet-exposed engineering workstation, never a real PLC; (2) an exposed WIBU CodeMeter license daemon (Server: WIBU-SYSTEMS HTTP Server) — the Rockwell FactoryTalk toolchain is exposed; (3) any co-exposed VNC, Telnet, or FTP on a PLC host — direct HMI/SCADA manipulation paths.

External attack-surface analysis — cellular-modem field devices are the dominant exposure population (the majority of internet-exposed Rockwell PLCs sit on cellular-carrier ASNs). Enumerate the organization's cellular-connected remote sites (pump stations, substations, lift stations) and confirm each PLC/modem is behind a gateway with MFA rather than directly reachable. Establish continuous monitoring via Shodan Monitor and/or a scheduled Censys query so new exposure is alerted rather than discovered at the next hunt.

Threat Actor Profile

Attribution: Iran-affiliated advanced persistent threat activity assessed by the FBI, CISA, NSA, EPA, DOE, U.S. Cyber Command, and (as of the July 22, 2026 update) the Department of the Treasury as intended to cause disruptive effects within the United States, likely in response to hostilities between Iran, the United States, and Israel. The activity is the successor to the IRGC Cyber Electronic Command-affiliated actor publicly tracked as CyberAv3ngers (aka Shahid Kaveh Group; the July 22 STIX bundle formally lists the actor identities HYDROKITTEN, CYBER AVENG3RS, BAUXITE, APT Iran, and Iranian-affiliated APT under the IRGC), which compromised at least 75 Unitronics PLC/HMI devices in the November 2023 water-sector campaign.

Sophistication: Moderate but effective and consequence-focused. The current campaign is notably more sophisticated than the 2023 Unitronics operation: rather than exploiting default credentials, the actors abuse legitimate engineering software (Studio 5000 Logix Designer, EcoStruxure Control Expert, TIA Portal) to form accepted connections to exposed controllers across three major vendors — activity that closely resembles routine engineering work and evades signature-only controls. They demonstrate OT-specific knowledge (project-file structure, ladder logic, reusable code modules) and operational discipline: a single multi-homed Windows workstation running the full Rockwell toolchain in AS214036 served as the operator launch pad, and a separate single-use staging box in AS9009 was provisioned weeks ahead, activated for one operation, and abandoned. The July 22 indicator refresh added operator infrastructure across additional overseas hosting providers (185.225.17.0, 84.200.205.0, 88.80.150.0, 175.110.121.0, 141.11.164.0, 192.142.54.0, and 79.133.46.0 ranges).

Access path and TTPs: Initial access is direct exploitation of internet-exposed PLCs (T0883) from overseas leased infrastructure. Command and control uses common OT ports (T0885: 44818, 2222, 102, 502) plus Dropbear SSH over port 22 (T1219). The actors exfiltrate controller project files via the vendor software (T1041), then achieve impact by replacing or amending ladder logic and Add-On Instructions (T0889) — in at least one case disabling alarm and shutdown logic — and manipulating HMI/SCADA data (T1565). Motivation is disruption and physical consequence, not financial gain or espionage — though operational disruption and financial loss to victims have resulted.

Data Sources Required

Network: perimeter and internal firewall logs (allow/deny on 44818/2222/102/502/22), NetFlow/IPFIX at the OT/IT boundary, full-payload PCAP from a SPAN/TAP at Purdue Level 3/3.5 (bidirectional, jumbo-frame-capable), and DNS logs from OT-adjacent resolvers.

Endpoint: CrowdStrike Falcon telemetry (ProcessRollup2, NetworkConnectIP4, FileWritten-family events) from EWS, HMIs, historians, and jump hosts; Windows Security/Sysmon Event Logs (4688, 4624/4625, 5156, Sysmon 1/3/11); Linux auditd/syslog where OT gateways run Linux.

OT/ICS: OT monitoring platform data from any deployed system — Dragos (Communications Hub, QFDs, Notifications, PCAP), Claroty CTD (Communication Analysis, OT-Activity, PCAP export), Nozomi Guardian (N2QL, links/nodes/variables, STIX feed), Tenable OT (Events, Findings, Code Snapshot diffs via GraphQL), Forescout eyeInspect (Command Center alerts, ICS Patrol), and Armis Centrix (ASQ ip-connections, alerts). Controller-side: PLC code/firmware snapshots, HMI/SCADA historian and alarm logs, and engineering change-management records.

External / OSINT: internet-scan datasets — Shodan (web console, CLI, Monitor alerts) and Censys (web console/Platform, CLI, hosts search API) — for external attack-surface enumeration of the organization's own address space and detection of actor operator infrastructure. Ingest the AA26-097A STIX/JSON IOC feed directly into the SIEM/TIP.

Vendor/device: Rockwell, Schneider, and Siemens controller identity (product code, firmware revision) for CVE matching; project-file baselines (.ACD/.STU/.ZAP) for logic diffing.

Detection Signatures

SIGMA rule 1 (process_creation) — engineering software or SSH tunneling launched on a host that should not run it:

SIGMA rule 2 (network_connection) — outbound connection to OT control ports toward an external address:

SIGMA rule 3 (file_event) — vendor PLC project file written by a non-engineering process:

Snort/Suricata rule 1 — EtherNet/IP CIP write/control service inbound from outside the OT network:

Snort/Suricata rule 2 — Siemens S7comm CPU STOP job (port 102):

Snort/Suricata rule 3 — connection to a published Iran-affiliated operator IP (July 22, 2026 IOC set):

YARA rule 1 (file/disk) — Dropbear SSH implant on disk. This rule targets a Dropbear binary staged on a Windows/Linux OT endpoint, the tool the actors deploy for port-22 remote access. The condition ORs the distinctive Dropbear banner/version strings against the ELF/PE magic so it fires on both native Linux builds and Windows-ported binaries; the multi-string threshold reduces false hits on documentation or config files that merely mention "dropbear".

YARA rule 2 (process memory) — Dropbear SSH in process memory. This rule targets a running Dropbear/SSH tunnel process, catching the case where the binary was deleted from disk but the implant is resident. It looks for the banner plus key-exchange and channel strings present in a live SSH server's memory; requiring the banner together with at least one protocol artifact avoids matching benign SSH clients that only transiently hold a banner string.

Indicators of Compromise

Network IOCs (published CISA IOCs — 21 IP addresses, July 22, 2026 STIX set):

Network IOCs (community-identified adjacent operator IPs — via Censys RDP-certificate pivot; NOT official CISA IOCs, same multi-homed workstation/ASN/cert family):

Host IOCs:

OT/operational IOCs (behavioral, scoped to this hunt):

Intelligence feed note: the July 22, 2026 STIX set (AA26-097A STIX XML/JSON) is the authoritative machine-readable source; ingest it directly from the CISA advisory page (cisa.gov/news-events/cybersecurity-advisories/aa26-097a) into the SIEM/TIP block list. The STIX bundle formally names the Dropbear and Secure Shell (SSH) tooling and the actor identities HYDROKITTEN / CYBER AVENG3RS / BAUXITE / APT Iran under the IRGC.

False Positive Baseline

1. Sanctioned engineering workstations running Studio 5000 / EcoStruxure Control Expert / TIA Portal / RSLinx during authorized maintenance windows — allowlist by (host, user) pair after a two-week baseline.

2. Cloud-hosted or DMZ historians and licensed remote OT services that legitimately terminate on OT ports from routable addresses — verify destination ownership before treating an "external" connection as malicious.

3. Backup, file-sync (OneDrive/vendor), or asset-management agents copying .ACD/.STU/.ZAP project archives — allowlist the specific writer process.

4. Vendor remote-support sessions (jump host / vendor VPN) that appear as new SSH or engineering flows — confirm against the ticketed support window and, where present, the brokered remote-access session log.

5. OT monitoring platform active-query traffic (Tenable OT active queries, Forescout ICS Patrol, Claroty active queries) that reads controller identity/state — read-only, scheduled, sourced from the sensor; exclude the sensor IPs.

6. Routine HMI/SCADA polling (EtherNet/IP Read Tag, S7 ReadVar, Modbus reads) at steady cadence from known HMI hosts — only write/control-class services are in scope.

7. Shodan/Censys own-scope results for assets that are intentionally and safely internet-facing (e.g., a hardened remote-access gateway) — document as risk-accepted; only unmediated PLC/HMI/EWS exposure is a finding.

Escalation Criteria

1. Any connection to or from a published Iran-affiliated IOC IP (any of the 21 in the July 22 STIX set), or a community-identified adjacent operator IP (185.82.73.160/.161/.163/.166/.169), involving an OT-adjacent asset — engage IR after vetting the address.

2. Any EtherNet/IP Write Tag / ForwardOpen / Reset, S7comm program download/upload or PLCStop, or Schneider UMAS write from a non-EWS or external source — immediate IR engagement and plant-operations notification.

3. Any vendor project file written by a non-engineering process, or any controller code-revision / Add-On-Instruction change without a matching change ticket — especially any change affecting alarm, shutdown, or interlock logic.

4. Any inbound engineering-protocol or SSH connection to a controller or EWS sourced from outside the OT network / from an internet-routable address.

5. Any Shodan/Censys own-scope result showing an unmediated PLC, HMI, or engineering workstation directly reachable from the internet — remediate exposure immediately; treat an EIP identity leaking a Windows hostname or an exposed CodeMeter daemon as high priority.

6. Any global Shodan/Censys hit on the operator markers (DESKTOP-BOE5MUC certificate family, vendor_id 0x004d with a DESKTOP-* product_name, or exposed WIBU CodeMeter tied to your ranges) — indicates actor infrastructure or a compromised exposed workstation.

7. Any YARA hit on Dropbear_SSH_Implant_Disk against an EWS, gateway, or jump host — isolate the host and preserve for forensics.

8. Any YARA hit on Dropbear_SSH_Process_Memory against a running process on an OT-adjacent host — capture the process image and network state before remediation.

9. Any PLC operating-mode change or HMI/SCADA displayed-value manipulation not attributable to a sanctioned operator action.

Hunt Completion Criteria and Reporting

The hunt is complete when: (a) all five hypotheses have been evaluated against every in-scope telemetry source with the queries above; (b) all 21 published IOC IPs and the community-identified adjacent operator range have been searched across the full retention window (back to November 2025 where available); (c) every internet-exposed OT device identified via Shodan/Censys own-scope queries has been confirmed either removed from direct exposure or explicitly risk-accepted; (d) all engineering-software executions and OT control/program-transfer services in the window have been attributed to a sanctioned host and change ticket or escalated; and (e) controller code snapshots — including reusable code modules and alarm/shutdown logic — have been diffed against a known-good baseline.

The report must document: the assets and telemetry sources in scope and any coverage gaps (e.g., NetFlow not forwarded, PCAP not retained at a given boundary, OT platform not covering a segment, cellular-modem sites without visibility); the queries run and their result counts; the external attack-surface findings (exposed hosts, with remediation status); every escalation raised and its disposition; and a mapping of findings to the AA26-097A MITRE ATT&CK techniques (T0883, T0885, T1219, T1565, T1041, plus the ICS program-modification techniques T0843/T0889). Where no adversary activity is found, the report must state the negative explicitly and note which coverage gaps limit confidence in that negative. Recommend follow-on hardening aligned to the advisory: remove PLCs from direct internet exposure behind a secure gateway, disable or secure cellular modems, set the controller mode switch to run and validate project-file integrity before returning to run mode, enforce MFA for external OT access, change default passwords, and disable unused services and default authentication keys.

Advisory IoC Reference