Detection of malicious or unwanted applications in the ICS environment

So, how do we go about finding malicious or unwanted code in our environment? Typically, the answer would be to find what is running right now and compare the findings against a known good state, a baseline. To give you an example of this method, we will now run a comparison between a baseline file and a current snapshot for Workstation12 in the lab. If you recall from Chapter 7, Active Security Monitoring, in the Assets scan section, we discovered an unusual open port (12345) on that workstation.

Comparing system snapshots to find artifacts

In Chapter 7, Active Security Monitoring, Exercise 2 – Manual inspection of industrial computers, we saw how we can pull system state snapshots from our end devices using msinfo32.exe and netstat. The following example shows how if we had a known good baseline copy of these snapshots, we could compare them against a current, freshly pulled snapshot. A convenient...