ICSpector: Solving Forensics Problems You Didn’t Know You Had

The ‎Microsoft‏ ‎ICS ‎Forensics ‎Tools ‎framework, known ‎as‏ ‎ICSpector, ‎is‏ ‎an‏ ‎open-source ‎tool ‎designed‏ ‎to ‎facilitate‏ ‎the ‎forensic ‎analysis ‎of‏ ‎Industrial‏ ‎Control ‎Systems‏ ‎(ICS), ‎particularly‏ ‎focusing ‎on ‎Programmable ‎Logic ‎Controllers‏ ‎(PLCs).

Key‏ ‎Technical ‎Points‏ ‎of ‎ICSpector

Framework‏ ‎Composition ‎and ‎Architecture

📌Modular ‎Design: ICSpector ‎is‏ ‎composed‏ ‎of‏ ‎several ‎components‏ ‎that ‎can‏ ‎be ‎developed‏ ‎and‏ ‎executed ‎separately,‏ ‎allowing ‎for ‎flexibility ‎and ‎customization‏ ‎based ‎on‏ ‎specific‏ ‎needs. ‎Users ‎can‏ ‎also ‎add‏ ‎new ‎analyzers

📌Network ‎Scanner: Identifies ‎devices‏ ‎communicating‏ ‎via ‎supported‏ ‎OT ‎protocols‏ ‎and ‎ensures ‎they ‎are ‎responsive.‏ ‎It‏ ‎can ‎work‏ ‎with ‎a‏ ‎provided ‎IP ‎subnet ‎or ‎a‏ ‎specific‏ ‎IP‏ ‎list ‎exported‏ ‎from ‎OT‏ ‎security ‎products.

📌Data‏ ‎Extraction‏ ‎& ‎Analyzer: Extracts‏ ‎PLC ‎project ‎metadata ‎and ‎logic,‏ ‎converting ‎raw‏ ‎data‏ ‎into ‎a ‎human-readable‏ ‎form ‎to‏ ‎highlight ‎areas ‎that ‎may‏ ‎indicate‏ ‎malicious ‎activity.

Forensic‏ ‎Capabilities

📌Identification ‎of‏ ‎Compromised ‎Devices: Helps ‎in ‎identifying ‎compromised‏ ‎devices‏ ‎through ‎manual‏ ‎verification, ‎automated‏ ‎monitoring, ‎or ‎during ‎incident ‎response.

📌Snapshot‏ ‎Creation: Allows‏ ‎for‏ ‎the ‎creation‏ ‎of ‎snapshots‏ ‎of ‎controller‏ ‎projects‏ ‎to ‎compare‏ ‎changes ‎over ‎time, ‎aiding ‎in‏ ‎the ‎detection‏ ‎of‏ ‎tampering ‎or ‎anomalies.

📌Support‏ ‎for ‎Siemens‏ ‎PLCs: Currently ‎supports ‎Siemens ‎SIMATIC‏ ‎S7-300‏ ‎and ‎S7-400‏ ‎families, ‎with‏ ‎plans ‎to ‎support ‎other ‎PLC‏ ‎families‏ ‎in ‎the‏ ‎future.

Integration ‎with‏ ‎Other ‎Tools

📌Microsoft ‎Defender ‎for ‎IoT: Can‏ ‎be‏ ‎used‏ ‎alongside ‎Microsoft‏ ‎Defender ‎for‏ ‎IoT, ‎which‏ ‎provides‏ ‎network-layer ‎security,‏ ‎continuous ‎monitoring, ‎asset ‎discovery, ‎threat‏ ‎detection, ‎and‏ ‎vulnerability‏ ‎management ‎for ‎IoT/OT‏ ‎environments.

Use ‎Cases

📌Incident‏ ‎Response: Useful ‎for ‎incident ‎response‏ ‎operations‏ ‎to ‎detect‏ ‎compromised ‎devices‏ ‎and ‎understand ‎if ‎PLC ‎code‏ ‎was‏ ‎tampered ‎with.

📌Proactive‏ ‎Security: Helps ‎in‏ ‎proactive ‎incident ‎response ‎by ‎comparing‏ ‎PLC‏ ‎programs‏ ‎on ‎engineering‏ ‎workstations ‎with‏ ‎those ‎on‏ ‎the‏ ‎actual ‎devices‏ ‎to ‎detect ‎unauthorized ‎changes.

Industries

📌Nuclear, ‎Thermal,‏ ‎and ‎Hydroelectric‏ ‎Power‏ ‎Plants: Power ‎plants ‎rely‏ ‎heavily ‎on‏ ‎Industrial ‎Control ‎Systems ‎(ICS)‏ ‎to‏ ‎manage ‎critical‏ ‎operations. ‎ICSpector‏ ‎can ‎be ‎used ‎to ‎ensure‏ ‎the‏ ‎integrity ‎of‏ ‎Programmable ‎Logic‏ ‎Controllers ‎(PLCs) ‎that ‎control ‎these‏ ‎processes.‏ ‎By‏ ‎detecting ‎any‏ ‎anomalous ‎indicators‏ ‎or ‎compromised‏ ‎configurations,‏ ‎ICSpector ‎helps‏ ‎prevent ‎disruptions ‎that ‎could ‎lead‏ ‎to ‎power‏ ‎outages‏ ‎or ‎safety ‎hazards.

📌Water‏ ‎Treatment ‎Plants: These‏ ‎facilities ‎use ‎ICS ‎to‏ ‎control‏ ‎the ‎treatment‏ ‎processes ‎that‏ ‎ensure ‎water ‎safety. ‎ICSpector ‎can‏ ‎help‏ ‎in ‎monitoring‏ ‎and ‎verifying‏ ‎the ‎integrity ‎of ‎PLCs, ‎ensuring‏ ‎that‏ ‎the‏ ‎water ‎treatment‏ ‎processes ‎are‏ ‎not ‎tampered‏ ‎with,‏ ‎which ‎is‏ ‎crucial ‎for ‎public ‎health ‎and‏ ‎safety.

📌Industrial ‎Manufacturing: In‏ ‎manufacturing‏ ‎environments, ‎ICS ‎are‏ ‎used ‎to‏ ‎control ‎machinery ‎and ‎production‏ ‎lines.‏ ‎ICSpector ‎can‏ ‎be ‎used‏ ‎to ‎detect ‎any ‎unauthorized ‎changes‏ ‎or‏ ‎anomalies ‎in‏ ‎the ‎PLCs,‏ ‎ensuring ‎consistent ‎product ‎quality ‎and‏ ‎preventing‏ ‎costly‏ ‎downtimes ‎due‏ ‎to ‎equipment‏ ‎failure.

📌Critical ‎Infrastructure‏ ‎Sectors: This‏ ‎includes ‎sectors‏ ‎like ‎energy, ‎water, ‎transportation, ‎and‏ ‎communication ‎systems.‏ ‎ICSpector‏ ‎can ‎be ‎used‏ ‎to ‎safeguard‏ ‎the ‎ICS ‎that ‎control‏ ‎these‏ ‎critical ‎infrastructures‏ ‎from ‎cyberattacks,‏ ‎ensuring ‎their ‎continuous ‎and ‎secure‏ ‎operation.

📌Chemical‏ ‎Processing ‎Plants: These‏ ‎plants ‎use‏ ‎ICS ‎to ‎manage ‎complex ‎chemical‏ ‎processes.‏ ‎ICSpector‏ ‎can ‎help‏ ‎in ‎ensuring‏ ‎that ‎the‏ ‎PLCs‏ ‎controlling ‎these‏ ‎processes ‎are ‎secure ‎and ‎have‏ ‎not ‎been‏ ‎tampered‏ ‎with, ‎which ‎is‏ ‎vital ‎for‏ ‎preventing ‎hazardous ‎incidents.

📌Oil ‎and‏ ‎Gas‏ ‎Industry: ICS ‎are‏ ‎used ‎extensively‏ ‎in ‎the ‎oil ‎and ‎gas‏ ‎sector‏ ‎for ‎drilling,‏ ‎refining, ‎and‏ ‎distribution ‎processes. ‎ICSpector ‎can ‎be‏ ‎used‏ ‎to‏ ‎monitor ‎and‏ ‎verify ‎the‏ ‎integrity ‎of‏ ‎these‏ ‎systems, ‎preventing‏ ‎disruptions ‎that ‎could ‎lead ‎to‏ ‎significant ‎financial‏ ‎losses‏ ‎and ‎environmental ‎damage