Detecting Potentially Malicious Activity in a Legacy OT Environment

The Challenge

For manufacturers operating complex industrial environments, legacy technology creates a difficult security challenge: critical systems need to remain operational, yet many were never designed for today’s threat landscape or modern security monitoring requirements.

A semiconductor manufacturer faced this challenge across a SCADA network containing numerous legacy systems and limited security visibility. The organization used Armis within its OT security environment, while Sygnia MDR provided additional visibility and 24/7 monitoring across its IT and CPS networks.

In an environment like this, detecting suspicious activity is only part of the problem. Security teams also need to determine whether individual events are benign administrative behavior or evidence of a developing compromise, without unnecessarily disrupting critical operations.

That challenge became immediate when Sygnia MDR detected potentially malicious activity within the environment.

The Detection

The initial alert gave Sygnia’s MDR analyst a starting point, but not enough information to determine what was actually occurring.

Rather than evaluating the alert in isolation, the MDR analyst investigated additional activity associated with the event. The investigation uncovered a series of behaviors that, taken together, warranted further attention.

The analyst identified activity potentially associated with several stages of an attack:

• Reconnaissance: execution of hostname -f, which can be used to identify the system’s fully qualified domain name.
  
• Additional system discovery: execution of getconf, providing further information about the host and its configuration.
  
• Possible privilege escalation: activity indicating a potential attempt to obtain elevated privileges.
  
• Persistence-related activity: execution involving a cron job, which required investigation to determine whether scheduled activity was legitimate or potentially being used to maintain access.

None of these behaviors alone necessarily proves malicious activity. Their significance came from examining them together and within the context of the affected OT environment.

Investigating the Activity, Not Just the Alert

This is where the distinction between monitoring and investigation becomes important.

Generic detections can identify potentially suspicious commands or behaviors. Experienced analysts still need to establish whether those activities make sense for the particular asset, user, and operating environment. 

The Sygnia analyst pivoted from the original alert into the underlying telemetry, using Velocity to investigate the sequence of activity and determine whether additional suspicious behaviors were present. The analyst identified activity potentially associated with several stages of an attack:

The emerging pattern provided more context than the original alert alone: the analysts were not looking at one anomalous command, but at activity spanning system reconnaissance, possible privilege escalation, and cron job execution.

That broader context gave the security team a stronger basis for escalation.

Rapid Communication With the Customer

Once the suspicious activity had been investigated, Sygnia’s MDR analyst communicated with the client via Signal.

Image 6: MDR analyst communication with client using Signal

This step is particularly important in operational environments.

OT containment decisions cannot always follow the same model used in conventional IT. Actions such as isolating a host, terminating connectivity, or shutting down a system may have consequences for production and operational continuity. Sygnia’s broader OT incident response methodology emphasizes coordinating containment decisions with operational stakeholders rather than automatically taking disruptive action.

The objective of MDR is therefore not simply to generate an alert. It is to give the organization enough validated information to make an informed decision about what should happen next.

Why Visibility Mattered

The case illustrates a recurring challenge in industrial cybersecurity: you cannot investigate what you cannot see.

The manufacturer’s SCADA environment contains numerous legacy systems and suffers from limited visibility. By deploying Pathfinder and bringing the resulting telemetry into Velocity, Sygnia analysts had additional data they could search when potentially malicious activity surfaced.

This matters because sophisticated detection in OT cannot depend exclusively on one sensor or one class of alert. Sygnia’s OT detection methodology emphasizes understanding the architecture, identifying visibility gaps, monitoring relevant attacker behaviors, and connecting signals across the environment.

In this case, that investigative visibility allowed the analyst to move from a broad “potentially malicious activity” alert to a more meaningful picture of what was occurring on the affected system.

From Individual Signals to an Investigative Story

The case also demonstrates why effective MDR requires more than alert forwarding.

Considered independently, commands such as hostname -f, getconf, or a cron job may have legitimate administrative uses. Automatically classifying them as malicious could create exactly the kind of alert noise that overwhelms security teams.

The analyst’s role is to determine what those signals mean together and in context.

Here, Sygnia’s investigation identified a sequence that included reconnaissance-related commands, possible privilege escalation, and scheduled task activity. The SOC team was then able to communicate the findings to the customer for further action.

That shift from isolated technical signals to contextual investigation is central to Sygnia’s approach to continuous security.

The Sygnia MDR Difference

Sygnia MDR is built around the same responder-informed approach that Sygnia applies during complex incident response engagements.

The Velocity platform is designed to ingest information across endpoints, networks, applications, cloud infrastructure, and OT environments, with over 250 third-party integrations and hundreds of detection rules, while allowing detections to be customized around a customer’s environment and threat landscape.

Sygnia’s detection model combines three types of rules: baseline detections for common threats, custom detections designed around the client’s environment, and IR-based detections informed by Sygnia’s frontline incident response experience.

For organizations operating legacy OT environments, that combination can be particularly valuable. Rather than requiring every industrial asset to support modern endpoint technology, security teams can combine available telemetry and investigate activity across multiple data sources.

And because MDR and Sygnia’s incident response operations use the same underlying platform, investigative context can be preserved if suspicious activity develops into an incident requiring a deeper response.

Key Takeaways for OT Security Leaders

This case highlights four practical lessons for organizations operating legacy industrial environments:

• Visibility is the foundation of effective OT detection. Legacy systems and fragmented architectures can leave security teams unable to investigate suspicious activity even when an alert exists.
  
• Behavior needs context. A command that appears suspicious may also have a legitimate operational purpose. Analysts need the ability to correlate multiple behaviors before reaching conclusions.
  
• Look for sequences, not isolated alerts. Reconnaissance, privilege-related activity, and persistence mechanisms become more meaningful when evaluated as part of a broader pattern.
  
• OT detection must connect to operationally informed response. Security teams need fast escalation, but containment decisions should account for production and operational consequences.

Turning OT Visibility Into Action

OT security is not simply a matter of deploying another monitoring technology. Effective detection depends on understanding what is normal, recognizing meaningful deviations, investigating activity across available telemetry, and giving defenders the context they need to act.

For this manufacturer, Sygnia MDR helped transform a potentially malicious activity alert into a deeper investigation of reconnaissance, possible privilege escalation, and persistence-related behavior, providing the customer with actionable context in an environment where visibility had historically been limited.