NSA CISA OT Assets Internet-Accessible Exploitation Guidance
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
NSA and CISA warn of active exploitation of internet-accessible operational technology assets; recommend immediate hardening and resilience planning.
NSA and CISA issued a joint activity alert in July 2020 documenting ongoing cyber threat activity against critical infrastructure, specifically targeting internet-accessible operational technology (OT) and control systems. The advisory does not attribute activity to a specific threat actor but notes that cyber actors have demonstrated willingness to conduct malicious operations against OT assets in DoD, National Security Systems, Defense Industrial Base, and civilian infrastructure sectors. The threat is not technically sophisticated but carries high impact potential due to the criticality of affected assets.
Observed tactics include spear-phishing for initial IT network access followed by lateral movement to OT networks, deployment of commodity ransomware for encryption, direct connection to unauthenticated PLCs via internet access, use of standard protocols and ports for controller communication, modification of control logic and parameters, and manipulation of control systems. Impacts observed include loss of availability, degraded operator visibility, loss of productivity and revenue, and adversarial manipulation of physical processes. The advisory emphasizes that organizations must assume hostile takeover scenarios where control systems actively operate contrary to safe operations.
NSA and CISA recommend immediate actions: creating resilience plans that assume inoperable or compromised control systems; exercising incident response plans with tabletop exercises; hardening networks by removing internet access where unnecessary, implementing segmentation and DMZs, enforcing strong authentication and encryption, disabling default credentials, and deploying intrusion detection; documenting accurate OT network maps and asset inventories; evaluating cyber risk against known vulnerabilities using public resources; and implementing continuous monitoring with integrity checks and anomaly detection.
Detection guidance
Pre-Encryption Recovery Inhibition Commonly Used by Commodity Ransomware
Detects shadow copy deletion, backup catalog deletion and boot recovery disabling via native Windows tools, which commodity ransomware typically runs before encrypting IT or OT-adjacent hosts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Pre-Encryption Recovery Inhibition Commonly Used by Commodity Ransomware
description: Detects native-tool commands that delete volume shadow copies, delete
the backup catalog, or disable Windows boot recovery. Commodity ransomware, as described
in the NSA/CISA OT alert, typically runs these immediately before encrypting files.
The rule matches the command pattern, not a specific malware family.
tags:
- attack.impact
- attack.t1486
- attack.t1490
logsource:
category: process_creation
product: windows
detection:
selection_vssadmin:
Image|endswith: \vssadmin.exe
CommandLine|contains|all:
- delete
- shadows
selection_wmic:
Image|endswith: \wmic.exe
CommandLine|contains|all:
- shadowcopy
- delete
selection_wbadmin:
Image|endswith: \wbadmin.exe
CommandLine|contains|all:
- delete
- catalog
selection_bcdedit:
Image|endswith: \bcdedit.exe
CommandLine|contains|all:
- recoveryenabled
- 'no'
condition: 1 of selection_*
falsepositives:
- Backup or storage maintenance scripts that purge shadow copies to reclaim disk space
- Administrators deliberately resetting backup catalogs or boot configuration during
system rebuilds
level: high
id: ad54ee4a-2ceb-514b-9649-63903a857808
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-205a
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-205a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs