Network forensics and ICS security
Reconstructing a multi-stage SCADA attack from packets
Problem
An external attacker defaced a safety-critical HMI by stepping from a low-value public asset into a secure OT network. The investigation had to answer the brief’s forensic questions from packet evidence alone, quantify asset risk, and recommend controls that would have broken the kill chain.
Coursework for Cyber Physical Systems Security (CSEC3002), submitted November 2025: an investigation into a multi-stage intrusion at “CTI Utilities”, a fictional water-treatment operator, using synthetic teaching captures. Alongside it, network-design work in Cisco Packet Tracer (VLANs, NAT, static routing) shows the segmentation the victim lacked.
What I did
Before touching the captures, I scored 17 assets with a CARVER matrix and modelled three attack pathways as an attack tree. The tree rated the direct route through the VPN server as the attacker’s best option: fewest dependencies, on end-of-life Ubuntu 18.04. The web-server route ranked lower because it is noisier and leaves more logs. I then reconstructed the actual intrusion packet by packet in Wireshark, correlating timestamps, IPs, ports and HTTP streams into interim forensic memos and a final incident report. The packets showed the attacker took the noisier web-server route, which the tree had ranked second.
Risk-based prioritisation (CARVER)
The CARVER matrix ranked the VPN Server (52) and the LIMS lab (49) as the most attractive targets (both running end-of-life Ubuntu), surfacing the systemic problem of unsupported software across critical assets.
Findings & recommendations
Three root-cause findings, plus a fix for the stolen-cookie hijack, drove a prioritised remediation plan.
- Insufficient network segmentation (critical): strict IT/OT firewall rules
- Weak access control: enforce MFA on all remote and RDP access
- Legacy and EOL systems: an emergency patch-management programme
- Hard HMI session timeouts to neutralise stolen-cookie hijacking
MITRE ATT&CK mapping
Nine techniques, each tied to a forensic memo, mapped across both matrices and visualised in ATT&CK Navigator.
- Enterprise: T1595 Active Scanning · T1592 Gather Victim Host Information · T1190 Exploit Public-Facing Application · T1110.001 Password Guessing (the failed brute force) · T1021.001 Remote Desktop Protocol · T1552.001 Credentials In Files (the stolen session cookie) · T1046 Network Service Discovery
- ICS: T0866 Exploitation of Remote Services (the malicious POST to the HMI web service) · T0832 Manipulation of View (the defaced HMI)
- Correction: the submitted report gives the two ICS techniques as T0862 and T0880. Those IDs are Supply Chain Compromise and Loss of Safety, so the IDs above are the corrected ones.
Secure-by-design networking
Separate Cisco Packet Tracer work built corporate topologies with VLAN segmentation, NAT and static routing: the controls whose absence let the CTI Utilities attacker cross from IT into OT.
Evidence
- Kill-chain stages reconstructed
- 4
- IT → pivot → OT → ICS
- Assets CARVER-scored
- 17
- VPN server highest at 52
- ATT&CK techniques mapped
- 9
- 7 Enterprise + 2 ICS, listed below
- Scanning source IPs
- 3
- distributed port scan, from the captures
Stack and tools
- 01ReconnaissanceDistributed scan from 3 IPs against the Web Server (192.168.121.151) on ports 22, 80 and 443.T1595 · Active Scanning
- 02Initial AccessA brute force on /wp-login.php was detected but failed; a different attack on the public web server gave the attacker access.T1190 · Exploit Public-Facing App
- 03Pivot / LateralWeb Server → GIT Server (dual IT/OT firewall access) → RDP (3389) into the Operations WS.T1021.001 · Remote Desktop
- 04ICS ImpactStolen JSESSIONID cookie → malicious upload (anonymous.gif) defacing the ScadaBR HMI.T0832 · Manipulation of View
| Technique | Tactic | In this case |
|---|---|---|
| T1595 Active Scanning | Reconnaissance | Active Scanning: the distributed scan from three IPs. |
| T1592 Gather Victim Host Information | Reconnaissance | Gather Victim Host Information. |
| T1190 Exploit Public-Facing Application | Initial Access | Exploit Public-Facing Application: initial access through the public web server. |
| T1110.001 Password Guessing | Credential Access | Password Guessing: the failed brute force. |
| T1552.001 Credentials In Files | Credential Access | Credentials In Files: the stolen session cookie. |
| T1046 Network Service Discovery | Discovery | Network Service Discovery. |
| T1021.001 Remote Desktop Protocol | Lateral Movement | Remote Desktop Protocol: the pivot into the operations workstation. |
| T0866 Exploitation of Remote Services | Initial Access, Lateral Movement (ICS) | Exploitation of Remote Services: the malicious POST to the HMI web service. The submitted report gave it as T0862 (Supply Chain Compromise) by mistake. |
| T0832 Manipulation of View | Impact (ICS) | Manipulation of View: the defaced HMI. The submitted report gave it as T0880 (Loss of Safety) by mistake. |
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Result
An incident report aligned to NIST SP 800-82 and 800-61, with forensic memos, an attack tree, CARVER scoring and ATT&CK mapping across both matrices, turning raw packets into business risk and concrete controls.