Detectando Ataques Estilo Stuxnet

Quando Usar

• Ao implementar detecção avançada de ameaças para alvos OT de alto valor (nuclear, químico, infraestrutura crítica)
• Ao construir detecção para ataques estilo APT visando a lógica de CLPs e manipulação de processos
• Ao estabelecer monitoramento de integridade da lógica de CLPs para detectar modificações não autorizadas
• Ao investigar anomalias de processo suspeitas que possam indicar ataques cibernéticos-físicos
• Ao projetar estratégias de defesa em profundidade contra ameaças OT em nível de estado-nação

Não use para detecção básica de intrusão em OT (veja detectando-ataques-em-sistemas-scada), para análise de malware de amostras Stuxnet (veja habilidades de engenharia reversa de malware), ou para programação e desenvolvimento de lógica de CLP.

Pré-requisitos

• Compreensão detalhada da cadeia de ataque Stuxnet e do framework MITRE ATT&CK para ICS
• Repositório de backup de lógica de CLP com cópias de linha de base conhecidas e boas de todos os programas de CLP
• Monitoramento de estação de engenharia (EDR com conhecimento de OT)
• Modelos de processo baseados em física para o processo físico controlado
• Monitoramento de rede para análise de tráfego de protocolos industriais

Fluxo de Trabalho

Etapa 1: Entenda a Cadeia de Ataque Stuxnet

Mapeie as oportunidades de detecção ao longo da cadeia de ataque estilo Stuxnet em várias etapas.

# Stuxnet-Style Attack Chain and Detection Points
attack_chain:
  stage_1_initial_access:
    technique: "USB-borne malware targeting air-gapped network"
    mitre_ics: "T0847 - Replication Through Removable Media"
    detection:
      - "USB device connection logging on engineering workstations"
      - "Removable media scanning with OT-approved AV"
      - "Application allowlisting blocking unauthorized executables"
      - "Windows autorun disabled via Group Policy"
    indicators:
      - "New USB device connections to engineering workstations"
      - "Execution of unsigned binaries from removable media"
      - "LNK file exploitation patterns"

  stage_2_lateral_movement:
    technique: "Exploitation of Windows vulnerabilities for network propagation"
    mitre_ics: "T0866 - Exploitation of Remote Services"
    detection:
      - "Network IDS detecting exploit traffic (MS08-067, MS10-061)"
      - "Unusual SMB traffic between engineering workstations"
      - "Windows event logs showing privilege escalation"
      - "New scheduled tasks or services created"
    indicators:
      - "Lateral movement between Level 3-4 Windows systems"
      - "WMI/PsExec execution from unexpected sources"
      - "Pass-the-hash authentication patterns"

  stage_3_ews_compromise:
    technique: "Compromise of engineering workstation with PLC programming software"
    mitre_ics: "T0862 - Supply Chain Compromise (Step-7 hooking)"
    detection:
      - "File integrity monitoring on Step-7/TIA Portal directories"
      - "DLL injection detection in PLC programming software"
      - "Monitoring s7otbxdx.dll for Stuxnet-specific hook"
      - "Unexpected modifications to PLC project files"
    indicators:
      - "Modified DLLs in Siemens STEP 7 installation directory"
      - "Rootkit hiding files on engineering workstation"
      - "PLC programming software behaving abnormally"

  stage_4_plc_logic_modification:
    technique: "Injecting malicious OB/FC blocks into PLC program"
    mitre_ics: "T0839 - Module Firmware / T0833 - Modify Control Logic"
    detection:
      - "PLC logic integrity comparison against known-good baseline"
      - "S7comm upload/download traffic from unauthorized sources"
      - "New OB/FC/FB blocks appearing in PLC program"
      - "Modification of OB1 (main scan) or OB35 (cyclic interrupt)"
    indicators:
      - "PLC program block count changes"
      - "PLC program size changes"
      - "Upload of unknown program blocks"

  stage_5_process_manipulation:
    technique: "Manipulating physical process while spoofing sensor readings"
    mitre_ics: "T0836 - Modify Parameter / T0856 - Spoof Reporting Message"
    detection:
      - "Physics-based anomaly detection (process model deviation)"
      - "Cross-validation of independent sensors"
      - "Vibration analysis and mechanical signature monitoring"
      - "Comparison of PLC-reported values vs independent measurements"
    indicators:
      - "Motor/pump operating outside normal parameters"
      - "Sensor readings diverging from physics model predictions"
      - "Process efficiency metrics deviating unexpectedly"

Etapa 2: Implemente o Monitoramento de Integridade da Lógica de CLP

…