OT Simulation

OT Simulation is a simulated Linux VM developed by Fortinet to address the OT industry’s need to detect malware which sends commands or collects data from their Industrial Control systems ( ICS ). The implementation in FortiSandbox uses an Industrial Security Signature contract in a Linux VM that simulates protocols such as Modbus, SNMP, IPMI, FTP and TFTP to detect the malware.

Preparing the OT Simulator VM on FortiSandbox

1. First, log in to Fortinet One, select Manage/View Products, and ensure the unit's Serial Number contains the "ISSS" contract and that it is not expired.
2. On the FortiSandbox System -> FortiGuard page, click the Connect FDN Now button to download the latest contracts and engines.

   

3. Wait for a while then refresh the FortiGuard page. There is a new entry for Industry Security Signature.

   

4. On the Dashboard page, under the System Information widget, check that the ISSS contract is downloaded and valid.

   

5. Go to the VM Image page and find LinuxOT under the Simulator VMs table.

   

6. Click the download icon in the status column of the LinuxOT row.
7. Click the Install button as below and wait for the installation to complete and the FortiSandbox to reboot.

   

8. After rebooting, the LinuxOT VM is installed with clone disabled.
9. Toggle the switch in the Clone # column to enable it then press Apply to save the changes.

   

Scanning the files with the Simulator VM enabled

1. To Scan a file using the Simulator VM, submit a scan job to the Windows VMs. The Simulator VM will detect network operations automatically.
2. After the scan is finished, check the job detail to confirm the following:
   • There should be more than one .pcap file in the PCAP Information section.
   • There should be at least one item containing the Lateral Movement category in the Network Operations section.