Lion Cipher Lab
Detect attacks in ICS/Modbus traffic: baseline the normal, then spot the anomaly (OT security, part 2)
- Threat Intel Analyst
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Part 1 ended on an uncomfortable fact: the Modbus protocol that runs pumps, breakers, and factory lines has no login and no encryption, so a device simply obeys any command it receives — and you cannot bolt a password onto a 20-year-old PLC. That raises the defender's real question: if you cannot stop the command, how do you even KNOW an attack happened? The answer is the beating heart of Operational Technology (OT) security work — you watch the traffic. Because a real control process is boringly repetitive (the same handful of sensors read on the same steady cadence), 'normal' is unusually…
What you'll learn
- reading Modbus/TCP traffic as a defender: telling a normal read-poll apart from an anomalous write
- knowing the standard Modbus function codes and which ones READ (safe polling) versus WRITE (change the device)
- recording a BASELINE of normal industrial traffic and using it as the yardstick for 'what is out of place'
- simulating an unauthenticated attack (unexpected writes to a PLC) against a device you own, then detecting it in the capture
- writing Wireshark display filters that isolate write commands, and reading the exact register and value an attacker changed
- turning the eyeball into a repeatable detector with tshark: extracting and counting function codes from a saved capture
- the core idea of OT detection engineering: an allow-list of expected (source, function code) pairs, and alerting on any deviation
- mapping what you saw to MITRE ATT&CK for ICS (Unauthorized Command Message, Modify Parameter)
- keeping the one rule: analyse only traffic from a local simulator you run, never a live industrial network
Steps in this lab
- The one rule, again: only traffic from your own simulator
- A 60-second recap: what Modbus is, and the words you need
- The function codes are your alphabet — learn which ones READ and which ones WRITE
- Set up the toolchain (same as part 1 — one install line)
- Stand up the simulated PLC (the device you will defend)
- Record the BASELINE: what normal, healthy traffic looks like
- Now the intrusion: a simulated attacker writes to the PLC
- Spot the anomaly: filter for writes and read exactly what changed
- Turn the eyeball into a detector with tshark
- The principle: baseline, allow-list, alert on deviation
- What you proved, and the career door it opens