ICS515: ICS Visibility, Detection, and Response

GIAC Response and Industrial Defense (GRID)
GIAC Response and Industrial Defense (GRID)
  • In Person (6 days)
  • Online
36 CPEs

ICS515: ICS Visibility, Detection, and Response will help you gain visibility and asset identification in your Industrial Control System (ICS)/Operational Technology (OT) networks, monitor for and detect cyber threats, deconstruct ICS cyber attacks to extract lessons learned, perform incident response, and take an intelligence-driven approach to executing a world-leading ICS cybersecurity program to ensure safe and reliable operations. Note: This class was previously named ICS515: ICS Active Defense and Incident Response. The course has gone through a significant update changing much of the content, most of the labs, and adding a day in course length.

What You Will Learn

ICS515: ICS Visibility, Detection, and Response will help you gain visibility and asset identification in your Industrial Control System (ICS)/Operational Technology (OT) networks, monitor for and detect cyber threats, deconstruct ICS cyber attacks to extract lessons learned, perform incident response, and take an intelligence-driven approach to executing a world-leading ICS cybersecurity program to ensure safe and reliable operations.

The course will empower students to understand their networked ICS environment, monitor it for threats, perform incident response against identified threats, and learn from interactions with the adversary to enhance network security. This approach is important to being able to counter sophisticated threats such as those seen with malware including STUXNET, HAVEX, BLACKENERGY2, CRASHOVERRIDE, TRISIS/TRITON, and ransomware. In addition, the efforts are also critical to understanding and running a modern day complex automation environment and achieving root cause analysis for non cyber-related events that manifest over the network. Students can expect to come out of this course with core skills necessary for any ICS cybersecurity program.

The course uses a hands-on approach with numerous technical data sets from ICS ranges and equipment with emulated attacks and real world malware deployed in the ranges for a highly simulated experience detecting and responding to threats. Students will also interact with and keep a programmable logic controller (PLC), physical kit emulating electric system operations at the generation, transmission, and distribution level, and virtual machine set up as a human machine interface (HMI) and engineering workstation (EWS).

Students will spend roughly half the course performing hands on skills across more than 25 technical exercises and an all day technical capstone. Students will gain a practical and technical understanding of defining an ICS cybersecurity strategy, leveraging threat intelligence, performing network security monitoring, and performing incident response. Frameworks such as the ICS Cyber Kill Chain, Collection Management Framework, and Active Cyber Defense Cycle will be taught to give students repeatable frameworks and models to leverage post class.

The strategic and technical skills presented in this course serve as a basis for ICS organizations looking to show that ICS defense is do-able.

  • How to perform ICS incident response focusing on security operations and prioritizing the safety and reliability of operations.
  • How ICS threat intelligence is generated and how to use what is available in the community to support ICS environments. The analysis skills you learn will enable you to critically analyze and apply information from ICS threat intelligence reports on a regular basis.
  • How to identify ICS assets and their network topologies and how to monitor ICS hotspots for abnormalities and threats. The course will introduce and reinforce methodologies such as ICS network security monitoring and approaches to reducing the control system threat landscape.
  • How to analyze ICS threats and extract the most important information needed to quickly scope the environment and understand the nature of the threat.
  • How to operate through an attack and gain the information necessary to instruct teams and decision-makers on whether operations must shut down or it is safe to respond to the threat and continue operations.
  • How to use multiple security disciplines in tandem to leverage an active defense and safeguard an ICS, all reinforced with hands-on labs and technical concepts.

You Will Be Able To

  • Analyze ICS-specific threats and take proper courses of action to defend the industrial control systems
  • Establish collection, detection, and response strategies for your ICS networks
  • Use proper procedures during ICS incident response

This Course Will Prepare You To

  • Examine ICS networks and identify the assets and their data flows in order to understand the network information needed to identify advanced threats
  • Use active defense concepts such as threat intelligence consumption, network security monitoring, malware analysis, and incident response to safeguard the ICS
  • Build your own Programmable Logic Controller using the SANS ICS515 Student Kit, which you retain after the class ends
  • Gain in-depth knowledge on ICS targeted threats and malware including STUXNET, HAVEX, BLACKENERGY2, CRASHOVERRIDE, TRISIS/TRITON, and EKANS
  • Leverage technical tools such as Shodan, Wireshark, Zeek, Suricata, Volatility, FTK Imager, PDF analyzers, PLC programming software, and more
  • Create indicators of compromise (IOCs) in YARA
  • Take advantage of models such as the Sliding Scale of Cybersecurity, the Active Cyber Defense Cycle, the Collection Management Framework, and the ICS Cyber Kill Chain to extract information from threats and use it to encourage the long-term success of ICS network security

Hands-On Training

  • Build a Programmable Logic Controller (PLC) using the SANS ICS515 Student Kit
  • Identify information available about assets online through Shodan
  • Complete an analysis of competing hypotheses
  • Ingest threat intelligence reports
  • Identify and leverage new active defense skills to guide incident responders to the Human Machine Interface (HMI) affected by an advanced persistent threat (APT) on the lab network
  • Identify which system is affected by APT malware identified in the network and assemble a sample of the threat that can be analyzed
  • From the infected HMI and samples of the APT malware identified, analyze the malware, extract information, and develop YARA rules to complete the active defense
  • Address three different hands-on, real-world scenarios, one involving live data collected from an intrusion into the SANS ICS515 Student Kit, and the other involving data collected from a Distributed Control System (DCS) infected with malware

What You Will Receive

  • Electronic Download package continuing ICS lab data such as packet captures and memory images
    • Protocol samples of OPC, ModbusTCP, DNP3, BACnet, EthernetIP/CIP, S7, and more
    • System files from infected DCS and HMI systems
  • A fully functioning SANS ICS515 Student Kit that students will keep following the class
    • A CLICK PLC Plus Controller, with additional modules and cards for communications with a sector simulation board
    • Physical components and attachments for I/O connections to the SANS sector simulator board
    • Commercial Click PLC Programming software from KOYO Electronics 
    • Commercial HMI control system runtime applications from Rockwell Automation
    • Commercial OPC server application software from Matrikon
  • A SANS ICS515 Windows Virtual Machine
  • A SANS ICS515 RELICS Virtual Machine

Syllabus (36 CPEs)

Download PDF
  • Overview

    Industrial control system (ICS) security professionals must be able to leverage internal and external threat intelligence to critically analyze threats, extract indicators of compromise (IOCs), document tactics, techniques, and procedures (TTPs), and guide security teams to find threats in the environment. On this first course day students will learn how threat intelligence is generated, how to critically analyze reports, and the basic tenets of active defense functions. Students will become better analysts and critical thinkers by learning skills useful in day-to-day operations, regardless of their jobs and roles. This day features five hands-on labs that include building a Programmable Logic Controller (PLC), identifying information available about assets online through Shodan, completing an analysis of competing hypotheses, visualizing the attack space combining Maltego and Shodan, and ingesting threat intelligence reports to guide their practices over the rest of the labs in the course.

    • Building a Programmable Logic Controller
    • Structured Analytical Techniques
    • Analysis of Intelligence Reports
    • ICS Information Attack Space
    • Maltego and Shodan Heatmap
    • Case Study: STUXNET
    • Introduction to ICS Active Defense and Course Scenario
    • Cyber Threat Intelligence Primer
    • ICS Cyber Kill Chain
    • Threat Intelligence Consumption
    • ICS Threat Landscape
  • Overview

    Understanding the networked environment is the only way to fully defend it: you cannot defend what you do not know. This day starts off with leveraging the PLC to perform electric grid system operations in an attempt to understand ICS operations better and what aspect of asset identification can help operations. Students will analyze packet captures, ICS protocols, and topologies across four hands on labs to learn what they can extract from network information to build asset inventories inclusive of equipment make and models, firmware, serial numbers, ports, protocols, and logical addressing information.

    The day is guided around the concept of a Collection Management Framework teaching students how to build a collection and visibility strategy tailored to their needs for both industrial operations and security operations.

    • Operating the Process
    • ICS Traffic Analysis
    • ICS Protocol Analysis
    • ICS Network Mapping
    • Case Study: Bhopal Disaster
    • Asset Inventories and Collection Management Frameworks
    • ICS Network Visibility and IT Discovery Protocols
    • Case Study: Ransomware and Prevention Atrophy
    • ICS Protocols
    • Case Study: DRAGONFLY - HAVEX
    • ICS Network Architectures and Topologies
  • Overview

    Threat detection is core to remaining resilient in the face of targeted and un-targeted ICS threats. In this section students will learn about the different types of detection and build a detection strategy for their ICS/OT networks. This will begin with instruction on what threat hunting is and how to accomplish it in the ICS safely. Students will spend the day in network captures from the courses ICS range to identify the beginning of an attack on the industrial environment and follow it through to completion. Across five hands-on-labs, students will learn to identify the difference between intrusions and Stage 1 of the ICS Cyber Kill Chain intrusions and then investigate a Stage 2 intrusion where the adversary is attempting to manipulate the logic of a controller.

    • Detecting Stage 1 Intrusions
    • Investigating Stage 2 Compromises
    • Traffic Analysis of Control Manipulation
    • Validating System Logic Changes
    • Logic Manipulation of Control Elements
    • Case Study: German Steelworks Attack
    • ICS Threat Hunting
    • Threat Detection Strategies
    • Case Study: SANDWORM - BlackEnergy 2 and BlackEnergy 3
    • ICS Network Security Monitoring
    • Event Analysis and Physical Consequence
  • Overview

    The ability to prepare for and perform ICS incident response is vital to the safety and reliability of control systems. ICS incident response is a core concept of ICS active defense and requires that analysts safely acquire digital evidence while scoping the environment for threats and their impact on operations. ICS incident response is a young field with many challenges, but during this section students will learn effective tactics and tools to collect and preserve forensic-quality data. Students will then use these data to perform timely forensic analysis leveraging techniques such as memory forensics. In this section's five hands on labs students will learn to safely acquire data, analyze initial infection vectors such as phishing emails, perform memory forensics, and analyze manipulated PLC logic.

    • Acquisition in an Operational Environment
    • PLC Logic and Protocol Root Cause Analysis
    • Analyzing Phishing Emails
    • HMI Memory Forensics
    • Process Triage
    • Case Study: SANDWORM - Ukraine 2015
    • ICS Digital Forensics and Incident Response Overview
    • Preparing an ICS Incident Response Team
    • Case Study: ELECTRUM and CRASHOVERRIDE - Ukraine 2016
    • Initial Compromise Vectors
    • Forensic Data Sources in ICS
  • Overview

    Understanding the threat is key to discovering its capabilities and its potential to affect the ICS. The information extracted from threats through processes such as malware analysis is also critical to being able to make the necessary changes to the environment to reduce the effectiveness of the threat. The information obtained is vital to an ICS active defense, which requires internal data collection to create and share threat intelligence. In this section, students will finish out the course scenario to identify the root cause of the failure in the ICS networks and craft a YARA rule on the malware for an IOC. For half the day, students will experience a mini-capstone with another complete scenario for students to put their skills to the test in a guided scenario that is educational.

    • Logic Analysis for Root Cause Analysis
    • Case Study: XENOTIME - TRISIS
    • ICS Threat and Environment Manipulation Goals and Considerations
    • Threat Analysis and Malware Triaging
    • YARA
    • Mini-Capstone
  • Overview

    This section is a full day long technical capstone where students will complete challenges that cover packet captures, logic, memory images, and more from compromised ICS ranges and equipment. This is intended to provide a fun and educational experience attempting to score the most points possible by solving technical challenges that prepare students for real world scenarios in ICS and OT.

GIAC Response and Industrial Defense

The GRID certification is for professionals who want to demonstrate that they can perform Active Defense strategies specific to and appropriate for an Industrial Control System (ICS) network and systems. Candidates are required to demonstrate an understanding of the Active Defense approach, ICS-specific attacks and how these attacks inform mitigation strategies. Candidates must also show an understanding of the strategies and fundamental techniques specific to core subjects with an ICS-focus such as network security monitoring (NSM), digital forensics and incident response (DFIR).

  • Active Defense Concepts and Application, Detection and Analysis in an ICS environment
  • Discovery and Monitoring in an ICS environment, ICS-focused Digital Forensics, and ICS-focused Incident Response
  • Malware Analysis Techniques, Threat Analysis in an ICS environment, and Threat Intelligence Fundamentals
More Certification Details


Students from either an IT or ICS background will do well in this course. Prior to attending the course, it is recommended that you attend SANS ICS410, ICS456, or equivalent essential cybersecurity classes such as SEC401, or that you have fundamental cybersecurity experience. Students do not need previous ICS experience, but they should be comfortable with ICS terminology and systems such as SCADA, DCS, PLCs, and RTUs, and have an understanding of distinct risks and mitigation approaches in OT environments.

Laptop Requirements

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

NOTE: It is critical that students have administrator access to the operating system and all security software installed. Changes may need to be made to personal firewalls and other host-based software in order for the labs to work.

  • Latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below.
  • 64-bit processor with 64-bit operating system
  • At least one USB port
  • Ability to update BIOS configuration settings to enable virtualization (VT) support
  • VMware Workstation Pro 15.5.X+, VMware Player 15.5.X+ or Fusion 11.5+
  • Access to an account with administrative permissions and the ability to disable all security software on your laptop such as Antivirus and/or firewalls if needed for the class
  • At least 160 GB of free hard-drive space
  • At least 8 GB of RAM 16 GB recommended
  • Wireless Ethernet 802.11 B/G/N/AC

NOTE: Apple systems using the M1 processor cannot perform the necessary virtualization at this time and cannot be used for this course.

Your course media will now be delivered via download. The media files for class can be large, some in the 40-50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

Author Statement

"This class was developed from my experiences in the U.S. intelligence community, at Dragos and within the control system community dealing with advanced adversaries targeting industrial control systems. It is the class I wish I would have had available to me while protecting infrastructure against these adversaries. It is exactly what you'll need to maintain secure and reliable operations in the face of determined threats. ICS515 will empower you to prove that defense is do-able." - Robert M. Lee

"The mixture of real-world stories and hands-on training make SANS my number one source for training." - Ian Trimble, Blue Cross Blue Shield


Very good for any ICS program, security-focused or not.
Jeremy Thomas
US Federal Department
This course was like a catalyst. It not only boosted my knowledge about the threats facing ICS environments and provided me with a framework to actively defend these threats, it also inspired me to learn more.
Srinath Kannan
Very good focus on the OT/ICS side & integrated into class.
Josh Tanski
Morton Salt

    Register for ICS515