XUTS LABS

XUTS LABS / ACADEMY / OT

OT Operator Study Hub

OT / ICS Offensive Security

Your central launch point for OT training, field references, threat intel, protocol study, pen test methodology, and operator-focused attack-path learning.

Start Guided Track →Open Field Library →Pen Test Manual →

Connected Sections

Everything OT connects here

Back to Academy →

Guided Track

OT / ICS Track

Follow the structured OT operator learning path: fundamentals, segmentation, protocols, engineering workstations, historians, PLCs, lateral movement, and safety systems.

Reference

OT Field Library

Study industrial protocols, common vendors, Purdue levels, OT asset roles, ports, safety notes, and operator guidance.

Threats

OT Threat Intel

Learn OT threat groups, ICS malware, sector targeting, defensive lessons, and why campaigns like TRITON, Industroyer, Stuxnet, and PIPEDREAM matter.

Methodology

OT Pen Test Manual

Use a safety-first OT assessment workflow: scoping, passive discovery, controlled validation, attack-path analysis, no-touch rules, and reporting.

Node Library

Attack Nodes

Browse all individual attack and study nodes by category, including OT / ICS, Active Directory, web, SQL, privilege escalation, and lateral movement.

Two-Week Study Flow

Use this as your main study route

Day 1

OT Foundations

  • • Purdue Model
  • • OT vs IT
  • • Asset roles
  • • Safety-first methodology

Day 2

Protocols

  • • Modbus
  • • DNP3
  • • EtherNet/IP
  • • OPC UA

Day 3

Vendors & Assets

  • • Rockwell
  • • Siemens
  • • Schneider
  • • Historians
  • • Engineering workstations

Day 4

Pentest Methodology

  • • Scoping
  • • Passive discovery
  • • No-touch rules
  • • Controlled validation

Day 5

Threat Intel

  • • XENOTIME
  • • ELECTRUM
  • • CHERNOVITE
  • • KAMACITE
  • • ICS malware

Day 6–7

Operator Review

  • • Explain concepts aloud
  • • Walk attack paths
  • • Practice panel answers

Operator Reminder

OT confidence comes from methodology, not tool dumping.

Focus on explaining why passive discovery matters, why active testing can be dangerous, how Purdue levels influence attack paths, why engineering workstations and historians matter, and how to validate risk without disrupting operations.