OT SECURITY STUDIO — SYNTHETIC PACKAGING CELL EVIDENCE

All addresses, events, MAC addresses and packets are invented for training.
PCAP: four standalone Ethernet/IPv4/TCP Modbus requests. No handshakes, responses, real equipment, or complete TCP sessions are represented. Checksums are computed. Interpret time in UTC on 2026-11-03.

EVT-01 09:00: read holding registers, source 10.20.1.10.
EVT-02 09:10: write multiple registers, source 10.20.1.30; no matching approved maintenance.
EVT-03 10:15: write multiple registers, source 10.20.1.35; approved maintenance.
EVT-04 10:20: read holding registers, source 10.20.1.10.

Maintenance approval is context in the JSON/CSV, not a field in the packets. Packet writes alone do not establish malicious intent or physical impact. Register 120 has no physical semantics in this invented scenario.

For offline analysis in Wireshark. Do not replay training traffic against production equipment.
