Generic network detections miss the behaviors that actually matter on a control network. A small set of protocol aware rules per protocol will catch more real activity than a thousand IT signatures ever will.
Most SOCs monitoring OT traffic rely on generic network detections: unusual ports, unexpected destinations, volume anomalies. These are fine, but they miss the behaviors that matter most. The interesting activity on a control network happens inside the protocol.
Modbus/TCP
High value rules:
- Function code 8 (diagnostics) from any host that is not an engineering workstation.
- Function code 43 (read device identification) from a source that has never issued it before.
- Any write function code (5, 6, 15, 16, 22, 23) from a source that has only ever read.
- Rapid enumeration across a wide register range from a single source in a short window.
DNP3
High value rules:
- Cold restart or warm restart function codes from unexpected sources.
- Unsolicited response enable or disable from anything but the master.
- Direct operate without ack from a source that normally uses select before operate.
IEC 60870-5-104
High value rules:
- General interrogation (C_IC_NA_1) from a host that is not the SCADA master.
- Command with unusual originator address values.
- STARTDT and STOPDT sequences at abnormal cadence, which can indicate session probing.
IEC 61850 MMS
High value rules:
- New MMS associations from hosts that have no history of speaking to a given IED.
- File transfer operations against IEDs outside of scheduled maintenance windows.
- GetNameList sweeps that enumerate logical nodes rapidly.
Making it stick
Rules like these fail when they are written once and never tuned. Every OT environment has legitimate quirks (a specific vendor tool that issues diagnostic reads on startup, a contractor pattern that looks alarming until you know its context). Treat the first month of any protocol aware rule as tuning, not detection. After that, they become the highest signal alerts your SOC has for OT.
ThreatSpire pairs these detections with the honeypot fleet so that the same rule set catches activity on real assets and on decoys, giving you both defensive coverage and outside adversary telemetry from one investment.