Wazuh enhances the security of Rapid SCADA by providing malware detection, file integrity monitoring, log analysis, and vulnerability assessment tailored for SCADA environments. This integration enables real-time visibility into system changes, suspicious activities, and potential threats, helping protect critical industrial infrastructures. #Wazuh #RapidSCADA
Keypoints
- Rapid SCADA is an open-source SCADA platform used for industrial automation, requiring robust security to protect against cyber threats and unauthorized access.
- Wazuh supports SCADA by monitoring endpoints for malware, unauthorized configuration changes, and suspicious log activity using modules like File Integrity Monitoring (FIM) and Security Configuration Assessment (SCA).
- Wazuh integrates signature-based and behavioral malware detection methods including YARA, VirusTotal, ClamAV, Windows Defender, and rootkit detection for layered protection on SCADA hosts.
- Critical Rapid SCADA configuration directories and files are actively monitored in real time by Wazuh’s FIM module to detect unauthorized modifications or deletions.
- Wazuh monitors various Rapid SCADA log files (ScadaServer.log, ScadaAgent.log, ScadaWeb.log, ScadaComm.log) to detect anomalies, authentication failures, and brute force attacks through custom decoders and alerting rules.
- Custom rules are implemented on the Wazuh server to generate alerts on file modifications, user account manipulation, and multiple failed login attempts specific to Rapid SCADA environments.
- Testing demonstrated Wazuh’s ability to detect configuration changes, user account manipulations, and brute force login attempts, highlighting its effectiveness in securing Rapid SCADA systems.
MITRE Techniques
- [T1565.001] Data Manipulation – Used to detect changes to Rapid SCADA configuration files and user account files via file integrity monitoring (“Rapid SCADA: Configuration file modified”).
- [T1070.004] File Deletion – Alerts triggered on deletion of Rapid SCADA configuration files and user account data (“Rapid SCADA: File deleted”).
- [T1485] Data Destruction – Detected when Rapid SCADA configuration files are deleted, potentially indicating sabotage or malicious intent (“Rapid SCADA: Configuration file deleted”).
- [T1098] Account Manipulation – Detection rules monitor creation, modification, and deletion of user.dat, role.dat, and roleref.dat files indicating user account changes (“Rapid SCADA: User account manipulation”).
- [T1110] Brute Force – Identifies multiple failed login attempts against Rapid SCADA web interface, signaling potential brute force attacks (“Rapid SCADA: Brute force (multiple failed logins)”).
Indicators of Compromise
- [File Paths] Rapid SCADA configuration and log directories – C:SCADAConfig, C:SCADAScadaServerConfig, C:SCADAScadaWebConfig, and log files like ScadaServer.log, ScadaAgent.log.
- [File Names] Critical files monitored for integrity – config.xml, user.dat, role.dat, roleref.dat within SCADA directories indicating potential tampering.
- [IP Addresses] Source IPs associated with Rapid SCADA log events – detected in failed login and brute force attempts extracted from logs.
Read more: https://wazuh.com/blog/monitoring-rapid-scada-with-wazuh/