XUTS LABS
Back to Red Team Playbooks
OT / ICSRed Team Playbook

OT/ICS Discovery

Perform low-impact OT discovery that identifies protocols and roles without unsafe writes.

OTICSModbusDiscovery

Purpose

Separate safe protocol discovery from control actions in industrial networks.

Inputs

  • - OT_CIDR
  • - approved protocol list
  • - capture location

Prerequisites

  • - OT scope
  • - Safety rules
  • - Maintenance window if required
  • - Passive-first preference

Operator Assumptions

  • - No writes by default.
  • - Protocol checks must be rate-limited and approved.

Commands

Limited TCP discovery

Kali
nmap -sT -Pn --max-rate 20 -p 502,102,20000,44818,47808 OT_CIDR -oN ot_ports.txt

Why: Identify common OT protocol ports with conservative pacing.

Expected: Open Modbus, S7, DNP3, EtherNet/IP, or BACnet ports if present.

Modbus identification

Kali
nmap -sT -Pn -p502 --script modbus-discover TARGET_IP -oN modbus_discover.txt

Why: Read-only Modbus discovery where allowed.

Expected: Device identification or no response.

Decision Points

  • - If safety rules prohibit active scans, use passive capture.
  • - If PLC/HMI roles are unclear, stop before writes.
  • - If historian is found, treat it as sensitive evidence.

Follow-On Actions

  • - Network diagram
  • - Asset inventory
  • - Defensive validation

Evidence To Capture

  • - Scope approval
  • - Port scan output
  • - Protocol script output
  • - Packet capture reference

Common Failures

  • - Fragile devices drop connections
  • - Segmentation blocks scan host
  • - Protocol scripts require exact port

Operational Cautions

  • - No writes or state changes by default.
  • - Avoid aggressive timing in OT networks.

Related Content

OT ReferenceAsk EXO