TheGentlemen - OT Network Access: Unusual IT-to-OT Lateral Traffic
Detects unusual connections from IT subnets to known OT/ICS protocol ports (Modbus:502, DNP3:20000, EtherNet/IP:44818, S7Comm:102, OPC UA:4840, IEC 60870-5-104:2404, BACnet/IP:18245) within private IP ranges. This rule specifically looks for a high volume of connections (more than 5) from a single source IP to different destination IPs on these OT ports, excluding traffic from Rockwell devices, which might indicate lateral movement or reconnaissance by threat actors like TheGentlemen, who have historically targeted OT environments.
Microsoft Sentinel (KQL)
