Skill UI

This skill addresses advanced threat detection for critical infrastructure (OT/ICS). It monitors sophisticated, multi-stage cyber-physical attacks, focusing specifically on PLC logic integrity monitoring, detecting unauthorized modifications, and analyzing process anomalies. It covers the entire attack chain, from initial USB-borne access (IT) to process manipulation (OT).

This guide details the process of deploying and configuring Tofino industrial firewalls for critical OT/ICS environments. It provides architectural blueprints and Python-based rule generators to implement deep packet inspection (DPI) for key industrial protocols like Modbus, EtherNet/IP, and S7comm. This ensures granular, protocol-aware access control and robust zone segmentation for safeguarding SCADA and PLCs.

This tool provides comprehensive asset discovery and inventory management for Operational Technology (OT) and Industrial Control Systems (ICS) environments using the Claroty xDome platform. It utilizes passive monitoring and active querying to achieve full visibility into critical assets across Purdue Model levels, including PLCs, RTUs, and HMIs. Ideal for compliance assessments (e.g., IEC 62443) and onboarding brownfield sites.

A comprehensive tool designed for assessing the security posture of Programmable Logic Controller (PLC) firmware. It specializes in detecting critical vulnerabilities such as hardcoded credentials, undocumented debug interfaces, backdoor functions, and memory corruption flaws. The tool supports analyzing major industrial platforms (Siemens, Allen-Bradley) by performing static and dynamic analysis, and verifying firmware integrity against known-good baselines, adhering to standards like IEC 62443. Use only in authorized lab environments.

A specialized analyzer designed to examine Siemens S7comm and S7CommPlus protocol traffic. It helps security professionals assess the security posture of SIMATIC S7 PLCs, detecting vulnerabilities such as unauthorized program downloads, PLC stop commands, and potential integrity bypasses in Operational Technology (OT) environments.

This tool provides a structured methodology for assessing the security posture of SCADA Human-Machine Interface (HMI) systems. It evaluates potential vulnerabilities in web-based HMIs, thin-client configurations, authentication mechanisms, and communication pathways between HMIs and PLCs, ensuring compliance alignment with rigorous standards like IEC 62443 and NIST SP 800-82.