Summary

In this chapter, we went through the process of proving or disproving the hypothesis that there are malicious or unwanted applications running on assets in the industrial environment. We saw how by combining data, tools, techniques, and activities, we not only managed to prove our hypothesis but also found compromised systems in our environment. We even discovered the use of resource- and bandwidth-hogging software (uTorrent). This chapter covered the second of three hypotheses that, when performed successively, form an effective strategy to help clean up or verify the environment of a new or long-neglected part of the industrial network.

In the next chapter, we are going to perform threat hunting activities around the third hypothesis, There are suspicious external connections going into the industrial environment.