ot-lateral-movement-detectionlisted

## When to Use - Monitoring the OT boundary for level-crossing traffic outside approved conduits. - Hunting for RDP, SMB, or SSH sessions that cross Purdue levels. - Investigating a vendor tunnel used outside its approved window. - Post-incident sweep for adversary staging between zones. ## Prerequisites - Suricata 7.x on the boundary span. Zeek 5.x on the same span. - `purdue-map.csv` from `ot-firewall-rule-review` or site documentation. One row per subnet: network, level. - Approved conduit list: which flows cross which levels, with windows for vendor access. - Python 3.10 or newer for the triage script. - Credentials: none for analysis. IDS reload rights for deployment. - Authorization: boundary owner sign-off for rule deployment. Live test traffic is gated. - Upstream skills: `passive-ot-network-discovery` for the flow baseline. ### Safety This skill is passive by default. Active steps are gated in the Workflow section. - Passive. Authors rules and analyzes captures and IDS logs. Safe to run during normal operations. ## Workflow 1. Load `purdue-map.csv` and classify the boundary sensors. Every rule below keys on the `$L1_NETS`, `$L2_NETS`, `$L3_NETS`, `$L35_NETS`, `$L4_NETS` variables. 2. Author the ruleset from `references/detection-rules.md`. The rules cover RDP, SMB, SSH, and WinRM crossings by adjacency class. 3. Validate offline: `suricata -T -c /etc/suricata/suricata.yaml` and `zeek -C -r baseline.pcapng scripts/lateral-movement`. 4. Deploy the ruleset to th