ICS/SCADA › Module 7 › Lesson 2
Anomaly Named
Anomaly detection literacy names baselines, engineering change alerts, and protocol anomalies — defensive use cases on YOUR $OT_LAB — defensive OT literacy only; no real-plant attacks, unauthorized OT scans, or exploit cookbooks.
Visual · t38_anomaly_named
Anomaly Named literacy. $OT_LAB only. Original Cyberlium.
Opening
OT anomalies include new masters, odd Modbus writes, and firmware changes — literacy names detection use cases, not spoofing live processes.
Anomaly detection in OT compares baselines for protocol traffic, tag change rates, and engineering sessions. Cyberlium lists anomaly use cases and alert triage rows on fictional templates — never instructions to inject spoofed process data on live HMIs. Cyberlium Topic 38 practices on $OT_LAB — YOUR fictional OT templates, zone diagrams, and labeled checklists under $HOME/cyberlium-lab/t38-ot/ no real-plant attacks, unauthorized OT scans, or exploit cookbooks. Next: Asset Inventory.
1. What Anomaly Named covers (named)
Anomaly literacy: new Modbus master, unexpected firmware download, after-hours engineering login, tag bulk edits. Triage: confirm with operations before automated blocking. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Write anomaly use case row — signal, severity, OT escalation contact stub. LAB-OT-001 fictional signals only. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Command guide
Try these commands — What Anomaly Named covers (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE ATT&CK for ICS — https://attack.mitre.org/matrices/ics/ CISA ICS — https://www.cisa.gov/topics/industrial-control-systems
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export OT_LAB=${OT_LAB:-$HOME/cyberlium-lab/t38-ot}
cat > "$OT_MONITOR/anomaly-use-cases.csv" <<'EOF'
use_case_id,signal,severity,escalation
A-001,new Modbus master,high,OT SOC + operations
A-002,after-hours engineering login,medium,OT SOC
A-003,unexpected firmware download,high,OT engineering
EOFCommand — copy this
grep -E 'A-00[1-3]|Modbus master' "$OT_MONITOR/anomaly-use-cases.csv"
Primary tools to practice this lesson: grep, python3. Reference sites: MITRE ATT&CK for ICS (https://attack.mitre.org/matrices/ics/); CISA ICS (https://www.cisa.gov/topics/industrial-control-systems). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why Anomaly Named matters for defenders
False positives disrupt operations — tune with OT engineers. Baselines require maintenance window awareness. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Students draft anomaly use cases on lab notes. Production follows OT SOC runbooks. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
3. $OT_LAB boundary
Forbidden: spoofing live process values for 'detection testing'. Allowed: anomaly use case literacy card. On $OT_LAB, document literacy rows on fictional LAB-OT-001 — never live plant IPs, credentials, or exploit steps.
Ship: anomaly use case row. Next: Asset Inventory.
4. What you ship: anomaly named card for $OT_LAB
Anomaly detection literacy names baselines, engineering change alerts, and protocol anomalies — defensive use cases. $OT_LAB named. NEVER real-plant attack steps. chmod 600.
5. What you record before the next lesson
Date (UTC). Anomaly Named card. $OT_LAB named. File t38-m07-l02-anomaly-named.txt chmod 600.
6. Wrong vs right: plant attacks vs YOUR OT lab sims
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Inject fake SCADA values on live HMI to test alerts.
Right
Write anomaly named card for YOUR $OT_LAB. Next: Asset Inventory.
Mission: document Anomaly Named on YOUR OT lab
1) Name literacy rows on $OT_LAB. 2) Write NEVER list (no real-plant attacks, unauthorized OT scans, or exploit cookbooks). 3) chmod 600. Never scan or exploit real industrial networks.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: literacy on $OT_LAB — not attack recipes against live plants.
Knowledge Check
APPLY: Anomaly Named on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Topic 38 includes ICS attack cookbooks against real plants.
True or False
Knowledge Check
APPLY: Anomaly Named literacy on Cyberlium uses:
Multiple choice