OT Cybersecurity Intrusion Analysis FROSTYGOOP ModbusPublished 9/2026
Created by Ed Galarza
MP4 |
Video: h264, 1920x1080 |
Audio: AAC, 44.1 KHz, 2 Ch
Level: Intermediate |
Genre: eLearning |
Language: English |
Duration: 13 Lectures ( 1h 15m ) |
Size: 473.5 MB
⚡ Explain how OT intrusion analysis differs from IT investigation, including the data sources that are unique to industrial environments.
⚡ Read a Modbus TCP capture in Wireshark and identify unauthorized reconnaissance and write activity by function code, source IP, and register range
⚡ Describe what FrostyGoop is, how it operates, and why it caused physical impact.
⚡ Correlate SCADA historian data against an independent field sensor to detect falsified process values.
⚡ Trace an attacker's path across the IT and OT boundary using firewall, VPN, and host-artifact logs.
⚡ Build a consolidated incident timeline mapped to MITRE ATT&CK for ICS
⚡ Produce a prioritized list of detection and segmentation improvements grounded in the evidence.
Requirements❗ This module assumes you are comfortable with basic TCP/IP and Wireshark navigation. If you have not done the Tier 1 Modbus TCP Exploitation module, I recommend completing that first - this module builds directly on that foundation.
DescriptionBy the end of this module, you will be able to do seven things. First: explain how OT intrusion analysis differs from IT investigation, including the data sources that are unique to industrial environments. Second: read a Modbus TCP capture in Wireshark and identify unauthorized reconnaissance and write activity by function code, source IP, and register range. Third: describe what FrostyGoop is, how it operates, and why it caused physical impact. Fourth: correlate SCADA historian data against an independent field sensor to detect falsified process values. Fifth: trace an attacker's path across the IT and OT boundary using firewall, VPN, and host-artifact logs. Sixth: build a consolidated incident timeline mapped to MITRE ATT&CK for ICS. And seventh: produce a prioritized list of detection and segmentation improvements grounded in the evidence.
The evidence pack for this module is the FrostyGoop Evidence Set - a simulated but structurally faithful collection of a PCAP, a SCADA historian CSV, an independent field sensor CSV, a perimeter router syslog, an OT firewall log, and two host artifacts from the compromised workstation. it from the resources section of this lecture.
One prerequisite note: this module assumes you are comfortable with basic TCP/IP and Wireshark navigation. If you have not done the Tier 1 Modbus TCP Exploitation module, I recommend completing that first - this module builds directly on that foundation
Overall you will learn to conduct Intrusion Analysis, Intrusion Detection Engineering, Network Traffic Analysis, etc.
Who this course is for⭐ OT Cybersecurity professionals who want to enhance their Intrusion Analysis and Incident Response skills.
⭐ Also any other Cybersecurity professionals who want to learn these skills.
Homepagehttps://www.udemy.com/course/ot-cybersecurity-intrusion-analysis-frostygoop-modbusRecommend Download Link Hight Speed | Please Say Thanks Keep Topic Live
No Password - Links are Interchangeable
Cantinho Satkeys
