CyberAv3ngers: Hunting Iranian OT Attacks on U.S. Water Systems

Threat Hunting IOCs & Queries

Known Indicators of Compromise

The following static indicators come from Claroty Team82's IOCONTROL analysis. Each victim generates a unique GUID that seeds the malware's MQTT identifiers and encryption, so behavioral hunting is more durable than indicator matching. Indicators are defanged as published.

• File Hash (SHA-256): 1b39f9b2b96a6586c4a11ab2fdbff8fdf16ba5a0ac7603149023d73f33b84498 (IOCONTROL sample)
• C2 Domains: tylarion867mino[.]com (parent), uuokhhfsdlk[.]tylarion867mino[.]com (C2 host), ocferda[.]com (legacy)
• C2 IP Address: 159[.]100[.]6[.]69 (Frankfurt; MQTT 1883/8883)
• DNS-over-HTTPS Resolver: https://1.1.1.1/dns-query (Cloudflare, used for C2 domain resolution)
• File Paths: /usr/bin/iocontrol, /etc/rc3.d/S93InitSystemd.sh, /tmp/iocontrol.log, /var/run/iocontrol.pid
• MQTT Topics: {GUID}/hello, {GUID}/push, {GUID}/output
• Ports of Interest: 8883/1883 (IOCONTROL MQTT), 20256 (Unitronics PCOM), 44818 & 2222 (Rockwell EtherNet/IP), 502 (Modbus), 102 (S7comm)
• Related Malware Names: OrpraCab, QueueCat (earlier tracking of IOCONTROL)

IOCONTROL MQTT Command-and-Control Over TLS

Behavior Targeted: Outbound MQTT sessions from OT or IoT segments to external hosts, the command-and-control channel used by IOCONTROL to blend in with legitimate IoT traffic.
MITRE ATT&CK: T1071 (Application Layer Protocol), T1573 (Encrypted Channel)
Expected Results: OT or IoT source addresses repeatedly reaching external destinations on port 8883 or 1883, often at a fixed interval.
False Positive Likelihood: LOW-MEDIUM
Tuning Guidance: Scope to your OT/IoT subnets and allowlist sanctioned vendor MQTT cloud endpoints; MQTT leaving an OT segment to the internet is rarely legitimate.

Splunk SPL Query

index=network sourcetype=pan:traffic earliest=-30d
    (dest_port=8883 OR dest_port=1883)
| where (cidrmatch("10.50.0.0/16", src_ip) OR cidrmatch("172.20.0.0/16", src_ip))   // TODO: your OT/IoT segments
| where NOT (cidrmatch("10.0.0.0/8", dest_ip) OR cidrmatch("172.16.0.0/12", dest_ip) OR cidrmatch("192.168.0.0/16", dest_ip))
| stats count AS sessions min(_time) AS first_seen max(_time) AS last_seen values(dest_ip) AS dest_ips by src_ip, dest_port
| where sessions > 5
| convert ctime(first_seen) ctime(last_seen)
| sort - sessions

// TUNING: Replace the OT/IoT source CIDRs with your environment's segments.
// TUNING: IOCONTROL beacons on a fixed interval; pivot on regular time deltas between sessions.
// FALSE POSITIVES: LOW-MEDIUM - allowlist sanctioned vendor MQTT cloud endpoints by dest_ip.

Microsoft KQL Query (Defender/Sentinel)

// CyberAv3ngers / IOCONTROL - MQTT over TLS beaconing from OT/IoT hosts
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemotePort in (8883, 1883)
| where RemoteIPType == "Public"      // external destinations only
| summarize Sessions = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
    RemoteIPs = make_set(RemoteIP, 20) by DeviceName, RemotePort
| where Sessions > 5
| order by Sessions desc

// TUNING: Scope DeviceName to OT gateways and IoT hosts; MQTT egress to public IPs is suspicious.
// TUNING: Correlate with regular-interval beaconing (a fixed delta between connections).
// FALSE POSITIVES: LOW-MEDIUM - allowlist sanctioned vendor MQTT cloud endpoints.

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

DNS-over-HTTPS Resolver Use from OT Segments

Behavior Targeted: OT hosts resolving domains through public DNS-over-HTTPS providers, the evasion technique IOCONTROL uses to hide C2 lookups from network monitoring.
MITRE ATT&CK: T1572 (Protocol Tunneling), T1071.004 (Application Layer Protocol: DNS)
Expected Results: Devices on OT segments connecting to public DoH resolver addresses on port 443, where those hosts should only use internal DNS.
False Positive Likelihood: LOW
Tuning Guidance: Restrict to OT source ranges; on IT endpoints, browsers legitimately use DoH, so this hunt is most reliable inside the OT boundary.

Splunk SPL Query

index=network sourcetype=pan:traffic earliest=-30d
    dest_port=443
    (dest_ip="1.1.1.1" OR dest_ip="1.0.0.1" OR dest_ip="8.8.8.8" OR dest_ip="8.8.4.4" OR dest_ip="9.9.9.9")
| where (cidrmatch("10.50.0.0/16", src_ip) OR cidrmatch("172.20.0.0/16", src_ip))   // TODO: your OT/IoT segments
| stats count min(_time) AS first_seen max(_time) AS last_seen by src_ip, dest_ip
| convert ctime(first_seen) ctime(last_seen)
| sort - count

// TUNING: Replace the OT/IoT source CIDRs with your environment's segments.
// TUNING: Add other DoH provider IPs used in your region to the destination list.
// FALSE POSITIVES: LOW - OT devices should resolve names through internal DNS only.

Microsoft KQL Query (Defender/Sentinel)

// CyberAv3ngers / IOCONTROL - DNS-over-HTTPS from OT/IoT hosts
DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemotePort == 443
| where RemoteUrl has "dns-query"
    or RemoteIP in ("1.1.1.1", "1.0.0.1", "8.8.8.8", "8.8.4.4", "9.9.9.9")
| summarize Count = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
    Urls = make_set(RemoteUrl, 10) by DeviceName, RemoteIP
| order by Count desc

// TUNING: Scope DeviceName to OT gateways and IoT hosts; internal DNS should be the only resolver.
// TUNING: Extend the resolver list with additional DoH providers seen in your environment.
// FALSE POSITIVES: LOW on OT segments; IT browsers use DoH legitimately.

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

Unauthorized Industrial Protocol Connections to Controllers

Behavior Targeted: Connections to PLC protocol ports from external or non-engineering sources, indicating an internet-exposed controller or unauthorized programming consistent with CVE-2021-22681 abuse.
MITRE ATT&CK: T1190 (Exploit Public-Facing Application), T0883 (Internet Accessible Device)
Expected Results: Sources outside the engineering workstation allowlist, or external addresses, reaching Unitronics PCOM (20256), EtherNet/IP (44818), Rockwell (2222), Modbus (502), or S7comm (102).
False Positive Likelihood: LOW
Tuning Guidance: Maintain an allowlist of sanctioned engineering workstations and HMIs; any other source reaching these ports is high priority.

Splunk SPL Query

index=network sourcetype=pan:traffic earliest=-7d action=allowed
    (dest_port=20256 OR dest_port=44818 OR dest_port=2222 OR dest_port=502 OR dest_port=102)
| eval proto=case(dest_port=="20256","Unitronics PCOM", dest_port=="44818","EtherNet/IP",
    dest_port=="2222","Rockwell", dest_port=="502","Modbus", dest_port=="102","S7comm")
| where NOT (cidrmatch("10.20.0.0/16", src_ip))   // TODO: engineering workstation / HMI ranges
| stats count dc(src_ip) AS distinct_sources values(src_ip) AS sources min(_time) AS first_seen max(_time) AS last_seen
    by dest_ip, dest_port, proto
| convert ctime(first_seen) ctime(last_seen)
| sort - count

// TUNING: Replace the allowlisted CIDR with your sanctioned engineering/HMI ranges.
// TUNING: Flag any external (non-RFC1918) src_ip separately as an internet-exposure alert.
// FALSE POSITIVES: LOW - PLC protocol traffic from unexpected sources warrants investigation.

Microsoft KQL Query (Defender/Sentinel)

// CyberAv3ngers - connections to industrial protocol ports from unexpected hosts
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort in (20256, 44818, 2222, 502, 102)
| extend Proto = case(RemotePort == 20256, "Unitronics PCOM", RemotePort == 44818, "EtherNet/IP",
    RemotePort == 2222, "Rockwell", RemotePort == 502, "Modbus", "S7comm")
| where DeviceName !in~ ("ENG-WKS-01", "ENG-WKS-02")   // TODO: sanctioned engineering workstations
| summarize Count = count(), Targets = make_set(RemoteIP, 20), FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, RemotePort, Proto
| order by Count desc

// TUNING: Replace the engineering-workstation allowlist with your sanctioned hosts.
// TUNING: For internet-exposure visibility, pair this with your OT boundary firewall logs.
// FALSE POSITIVES: LOW - industrial protocol traffic from non-engineering hosts is unusual.

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.

PLC Programming Software on Unexpected Hosts

Behavior Targeted: Execution of controller programming software outside sanctioned engineering workstations, consistent with project-file theft and control-logic tampering.
MITRE ATT&CK: T1005 (Data from Local System), T0889 (Modify Program)
Expected Results: Studio 5000 Logix Designer, RSLogix 5000, or VisiLogic launching on hosts that are not part of the engineering-workstation baseline.
False Positive Likelihood: LOW
Tuning Guidance: Allowlist sanctioned engineering workstations; pair with file-creation events for project file extensions to catch logic export or theft.

Splunk SPL Query

index=windows sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    earliest=-30d
    (Image="*\\LogixDesigner.exe" OR Image="*\\RSLogix 5000*" OR Image="*\\Studio 5000*"
     OR Image="*\\VisiLogic*" OR Image="*\\RSLinx*")
| stats count min(_time) AS first_seen max(_time) AS last_seen values(Image) AS images values(User) AS users
    by Computer
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

// TUNING: Allowlist sanctioned engineering workstations by Computer; any other host is high priority.
// TUNING: Add Sysmon EventCode=11 for creation of *.ACD, *.L5X, *.L5K, *.vlp, *.rss project files.
// FALSE POSITIVES: LOW - PLC programming software rarely runs outside engineering hosts.

Microsoft KQL Query (Defender/Sentinel)

// CyberAv3ngers - PLC engineering software on unexpected hosts (project theft / logic tampering)
DeviceProcessEvents
| where Timestamp > ago(30d)
| where FileName in~ ("LogixDesigner.exe", "RSLogix5000.exe", "VisiLogic.exe", "RSLinx.exe")
    or ProcessCommandLine has_any ("Studio 5000", "RSLogix 5000", "VisiLogic")
| summarize Count = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
    Users = make_set(AccountName, 10), Cmds = make_set(ProcessCommandLine, 5) by DeviceName, FileName
| order by LastSeen desc

// TUNING: Maintain an allowlist of sanctioned engineering workstations (DeviceName); alert on all others.
// TUNING: Pair with DeviceFileEvents for *.ACD, *.L5X, *.L5K, *.vlp, *.rss project file access.
// FALSE POSITIVES: LOW - this software is specific to OT engineering staff.

Note: These queries were generated with AI assistance. Test thoroughly in your environment before production use.