Lessons learned from OT attacks: Why behavioral detection beats signatures

Rethinking Signature-Based Detection for Power Utility Cybersecurity argues that signature-based detection, while still useful for commodity IT malware, is ill-suited to OT environments and power utilities.

The piece highlights historic OT incidents, including 2015 in Ukraine where BlackEnergy was linked to unscheduled outages (According to CISA, December 23, 2015), 2016’s CrashOverride, described as an “extensible platform” that abused industrial protocols, and 2017’s Triton malware designed to manipulate safety systems.

It contends that traditional signatures struggle to generalise across utilities and encourages utilities to prioritise behavioural analytics, anomaly detection, and cross-community threat intelligence, citing MITRE ATT&CK for ICS and ISACs as enabling more proactive defence. The article notes regulatory trends such as NERC CIP-015, which emphasises internal network anomaly monitoring and does not reference signature-based detection, underscoring a shift toward anomaly-based monitoring.

In conclusion, while signatures may help with IT malware, the authors urge utilities to adopt behavioural analytics and shared intelligence to detect novel and evolving OT threats.