Real-time monitoring identifies sh/bash/ash/zsh/BusyBox execution from an unexpected parent, unauthorized account, remote session, or non-approved script path, particularly when followed by OT-relevant network discovery, persistence, file modification, or communications. Alert only when the interpreter/shell is not expected for the asset role or user/service context, or when its parent, path, arguments, remote-session source, or follow-on behavior violates the approved OT baseline. Suppress approved engineering scripts, vendor support, diagnostics, backup, patching, and maintenance windows.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | auditd:SYSCALL | execve for shell/interpreter and child commands |
| Logon Session Creation (DC0067) | linux:syslog | auth.log/secure.log; SSH or console session context |
| Field | Description |
|---|---|
| ShellExecutable | Approved shell paths and BusyBox use |
| ParentProcess | Expected service/vendor parents |
| UserContext | Authorized users and service accounts |
| RemoteSource | Approved jump hosts and management subnets |
| CommandLinePattern | High-risk shell commands and ICS-relevant follow-on activity |
Real-time monitoring identifies network-device CLI or underlying Unix-like shell access from an unauthorized management source/account, followed by privileged or configuration commands outside an approved change window. Do not alert solely on CLI use. Require violation of the management matrix, command authorization, or change-control context.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | networkdevice:syslog | CLI command audit / configuration command history |
| Logon Session Creation (DC0067) | networkdevice:auth | SSH/Telnet/console authentication and session creation |
| Field | Description |
|---|---|
| ApprovedManagementSources | Jump hosts, management VLANs, and administrative CIDRs |
| AuthorizedAccounts | Named/network-service administrative accounts |
| HighRiskCommands | Enable/configure, ACL, route, NAT, firmware, file transfer, shell escape |
| ChangeWindow | Approved network maintenance/change ticket window |
Real-time monitoring identifies shell/CLI access to an embedded controller, gateway, HMI appliance, or IoT/OT device from an unauthorized source/account, or command execution that is inconsistent with the device role and approved maintenance workflow. Require a session/command authorization violation or corroborating configuration/firmware/process effect; do not infer maliciousness from deterministic timing alone.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | device:CLI | Device shell/CLI command audit when available |
| Logon Session Creation (DC0067) | device:auth | SSH/Telnet/console or vendor remote-management session |
| Field | Description |
|---|---|
| ApprovedManagementSources | Engineering workstations/jump hosts permitted to administer the device |
| AuthorizedAccounts | Approved local/vendor accounts |
| HighRiskCommands | Firmware, configuration write/erase, service manipulation, shell escape |
| DeviceRole | Whether interactive shell/CLI is expected on this device class |
| MaintenanceWindow | Approved vendor/engineering activity |