ICS/OT & Critical-Infrastructure OSINT

OSINT for industrial control systems, SCADA, and critical infrastructure:

34.1 Methodology & Frameworks

Resource	Type	URL
ICS-Cybersecurity-Audit (author's)	5-phase audit methodology, IEC 62443 / NIST 800-82	https://github.com/frangelbarrera/ICS-Cybersecurity-Audit
MITRE ATT&CK for ICS	Tactics & techniques matrix	https://attack.mitre.org/matrices/ics
CISA ICS Advisories	Vulnerability advisories	https://www.cisa.gov/news-events/cybersecurity-advisories
ICS-CERT	US-CERT industrial alerts	https://us-cert.cisa.gov/ics

34.2 Scanners & Tools

Tool	Function	URL
IndustrialScanner-Lite (author's)	Modbus/S7Comm/DNP3 PCAP analyzer	https://github.com/frangelbarrera/IndustrialScanner-Lite
Shodan ICS filters	ICS device search	https://www.shodan.io/search?query=port%3A502
Censys ICS	ICS device search	https://search.censys.io/search?resource=hosts&q=tags%3A%22ics%22
Claroty	OT security (vendor)	https://claroty.com
Nozomi Networks	OT security (vendor)	https://www.nozominetworks.com

34.3 Notable ICS Incidents (Case Studies)

Year	Incident	Target	Lesson
2010	Stuxnet	Natanz uranium enrichment (IR)	First digital weapon, S7 PLC reprogramming
2015	BlackEnergy	Ukraine power grid	First confirmed cyber-physical blackout
2016	Industroyer/CrashOverride	Ukraine power grid	Automated ICS protocol abuse
2017	TRITON/TRISIS	Saudi Petrochemical (SIS)	First attack on Safety Instrumented Systems
2021	Colonial Pipeline	US fuel pipeline (IT-side)	Ransomware OT impact without direct compromise
2022	Industroyer2	Ukraine energy sector	Modular ICS malware evolution

Full case studies: https://github.com/frangelbarrera/ICS-Cybersecurity-Audit/tree/main/docs/case-studies

34.4 Protocol-specific Dorks (Shodan)

port:502 country:DE        # Modbus
port:102 country:ES        # S7Comm
port:20000                 # DNP3
port:47808                 # BACnet
port:4840                  # OPC UA
"Schneider Electric"       # Quantum PLCs
"Siemens" port:102         # S7 devices

---