The OT Malware scans for presence of OT related applications and networking protocols. The LinuxOT is a Linux VM to simulate the OT industry deployment. The VM supports the Siemens application and simulates:
- TFTP protocols
The Sandbox Threat Intelligence subscription already includes the Industrial Security subscription which allows you to enable the simulation. To scan files, submit them through any Windows VM. If it is an OT Malware, the LinuxOT will capture that lateral movement behavior and access to those application and protocols.
- In Dashboard > Status > Licenses widget, check that the Industrial Security Service contract is valid.
- Go to the VM Image page and find LinuxOT under the Simulator VMs table.
- Click the download icon in the status column of the LinuxOT row.
- Click the Install button as below and wait for the installation to complete and the FortiSandbox to reboot.
- After rebooting, the LinuxOT VM is installed with clone disabled.
- Toggle the switch in the Clone # column to enable it then press Apply to save the changes.
- To Scan a file using the Simulator VM, submit a scan job to the Windows VMs. The Simulator VM automatically detects network operations related to the simulated protocols.
- After the scan is finished, check the job detail to confirm the following:
- There should be more than one .pcap file in the PCAP Information section.
- There should be at least one item containing the Lateral Movement category in the Network Operations section.