T0801 Monitor Process State — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0727 Detection of Monitor Process State

AN1860 Analytic 1860

Real-time network monitoring identifies a source issuing read-only Industrial Control System (ICS) protocol requests to multiple field devices at a polling rate exceeding the legitimate Supervisory Control and Data Acquisition (SCADA) baseline, from a source not in the approved control server allowlist. Because the action is read-only, source-identity and rate deviation are the only available distinguishing signals. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

AN2125 Analytic 2125

Real-time monitoring identifies a scripting interpreter or custom binary on an Industrial Control System (ICS) Linux asset making sustained, high-frequency Industrial Control System (ICS) protocol read connections to field device IPs, from a User Identifier (UID) not associated with the recognized historian or Supervisory Control and Data Acquisition (SCADA) service account. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

AN2169 Analytic 2169

Real-time monitoring identifies NetFlow showing a host generating an anomalously high volume of short-duration flows to multiple field device IPs at regular intervals, from a source not in the approved Supervisory Control and Data Acquisition (SCADA) server list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.

AN2206 Analytic 2206

Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host querying device operating state or process values via vendor Application Programming Interfaces (APIs) at a frequency or scope exceeding documented Human-Machine Interface (HMI) refresh behavior, from a process not in the recognized HMI/Supervisory Control and Data Acquisition (SCADA) application list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity.