Network Forensics & ICS Security

Reconstructing a multi-stage SCADA attack from packets

Network ForensicsICS / SCADAIncident ResponseMITRE ATT&CK Code

Kill-chain stages reconstructed

IT → pivot → OT → ICS

Assets CARVER-scored

VPN server highest at 52

ATT&CK techniques mapped

Enterprise + ICS matrices

Coordinated attacker IPs

distributed port scan

Context

A Cyber-Physical Systems Security investigation into a multi-stage intrusion at “CTI Utilities”, a water-treatment operator, combined with enterprise network-design work in Cisco Packet Tracer (VLAN/NAT/static routing) that demonstrates the segmentation the victim lacked.

The problem

An external attacker defaced a safety-critical HMI by stepping-stone from a low-value public asset into a secure OT network. The investigation had to answer the brief’s forensic questions from packet evidence alone, quantify asset risk, and recommend controls that would have broken the kill chain.

My approach

I scored 17 assets with a CARVER matrix to prioritise defence, modelled three attack pathways as an attack tree (selecting the direct VPN route as optimal), then reconstructed the actual intrusion packet-by-packet in Wireshark — correlating timestamps, IPs, ports and HTTP streams into interim forensic memos and a final incident report.

Reconstructed kill chain · IT → OT

01
Reconnaissance
T1595 · Active Scanning
Distributed scan from 3 IPs against the Web Server (192.168.121.151) — ports 22 / 80 / 443.
02
Initial Access
T1190 · Exploit Public-Facing App
Brute force on /wp-login.php → WordPress admin compromise on the public web server.
03
Pivot / Lateral
T1021.001 · Remote Desktop
Web Server → GIT Server (dual IT/OT firewall access) → RDP (3389) into the Operations WS.
04
ICS Impact
T0880 · Manipulation of View
Stolen JSESSIONID cookie → malicious upload (anonymous.gif) defacing the ScadaBR HMI.

Risk-based prioritisation (CARVER)

The CARVER matrix ranked the VPN Server (52) and the LIMS lab (49) as the most attractive targets — both running end-of-life Ubuntu — surfacing the systemic problem of unsupported software across critical assets.

Findings & recommendations

Three root-cause findings drove a prioritised remediation plan.

Insufficient network segmentation (CRITICAL) — strict IT/OT firewall rules
Weak access control — enforce MFA on all remote / RDP access
Legacy / EOL systems — emergency patch-management programme
Hard HMI session timeouts to neutralise stolen-cookie hijacking

MITRE ATT&CK mapping

Behaviours were mapped across both matrices: Enterprise (T1595 Active Scanning, T1190 Exploit Public-Facing App, T1110.001 Brute Force, T1021.001 RDP, T1552.001 Credentials in Files) and ICS (T0862 Exploitation of Remote Services, T0880 Manipulation of View) and visualised in ATT&CK Navigator.

Secure-by-design networking

Complementary Cisco Packet Tracer work built high-availability corporate topologies using VLAN segmentation, NAT and static routing — the exact controls whose absence enabled the CTI Utilities breach, and passing 100% of simulation tests.

Outcome

A complete incident report aligned to NIST SP 800-82 / 800-61, with forensic memos, an attack tree, CARVER scoring and dual-matrix ATT&CK mapping — translating raw packets into board-level business risk and concrete controls.

Next case studyIncident Response Maturity & Threat Intel Hire me