Investigate an unexpected PLC write
Compare a write event with the maintenance record before escalating an incident.
By Abdul Khadir Mahamed · Updated 3 November 2026
Independent guided exercise using synthetic evidence. No live industrial systems are connected.
Your scenario
A monitoring alert reports a write to a simulated controller. Determine whether available evidence supports authorized maintenance.
Evidence to examine
09:10 source=10.20.1.30 destination=10.20.1.20 function=16 09:11 holding register 120 changed from 40 to 55 Approved work: 10:00–11:00, source=10.20.1.35 All timestamps use the same site clock
Your investigation tasks
- Identify differences between the observed event and approval.
- Draft detection logic using the source, function, and maintenance context.
- List process checks and evidence to collect before containment.
Debrief
Review the reasoning after completing the tasks
The time and source do not match the approval. Function 16 writes multiple holding registers, but the physical meaning of register 120 requires the process register map. Investigate identity, workstation activity, time synchronization, and process impact. A write is not inherently malicious.
Take it back to the process
Separate observed facts from assumptions. Explain the operational consequence of your decision, name the evidence still needed, and identify who must approve or validate a real-world change.