Specialized Forensics by Domain

Author

K19G

Updated

October 31, 2026

Specialized Forensics by Domain

Enterprise IT networks are only one facet of modern connected infrastructure. A comprehensive network forensics methodology must extend to specialized operational and mission-critical domains: Industrial Control Systems (ICS/SCADA), the Internet of Things (IoT), Cloud and Containerized Platforms, Healthcare and Medical Devices (IoMT), and Interdependent Smart City Infrastructures.

Each domain features specialized network architectures, proprietary protocols, legacy constraints, and distinct failure modes. An anomaly that represents benign developer traffic in a cloud development cluster (e.g., thousands of rapid ephemeral socket connections) indicates an existential physical safety threat inside an industrial control system.

┌────────────────────────────────────────────────────────────────────────┐
│               Specialized Network Forensic Domains                     │
└────────────────────────────────────────────────────────────────────────┘
        │                            │                            │
        ▼                            ▼                            ▼
┌──────────────────┐       ┌──────────────────┐       ┌──────────────────┐
│  ICS / SCADA / OT│       │ Cloud & Container│       │   IoT & Smart    │
│  (Purdue Model)  │       │ (VPC, K8s, eBPF) │       │   Infrastructure │
└────────┬─────────┘       └────────┬─────────┘       └────────┬─────────┘
         │                          │                          │
         │ - Modbus, DNP3, S7comm   │ - VPC Flow, Envoy mesh   │ - MQTT, CoAP, Zigbee
         │ - Deterministic cadence  │ - Ephemeral IP lifecycles│ - Firmware extraction
         │ - Zero tolerated jitter  │ - Control plane API logs │ - Device fingerprinting
         ▼                          ▼                          ▼
┌────────────────────────────────────────────────────────────────────────┐
│              Domain-Specific Behavioral Anomaly Engines                │
└────────────────────────────────────────────────────────────────────────┘

Operational Technology (OT) and ICS/SCADA Forensics

Industrial control systems operate physical plants: electrical grids, oil refineries, water treatment facilities, and nuclear generation sites. OT networks are architected according to the Purdue Enterprise Reference Architecture (ISA-95):

[ Enterprise IT / Corporate Network (Level 4/5) ]
                       │ (Firewall / DMZ Level 3.5)
                       ▼
[ Site Operations & Plant Monitoring (Level 3: Historians, Engineering Workstations) ]
                       │ (Internal Industrial Firewall)
                       ▼
[ Control Systems (Level 2: SCADA HMIs, Supervisory Servers) ]
                       │
                       ▼
[ Basic Control (Level 1: Programmable Logic Controllers [PLCs], RTUs) ]
                       │ (Hard Real-Time Industrial Fieldbus)
                       ▼
[ Physical Process (Level 0: Actuators, Valves, Turbines, Pumps) ]

Behavioral Invariants in Industrial Telemetry

  1. Extreme Protocol Determinism: In an industrial network, protocol communications are virtually clockwork. A PLC polls an RTU every \(250.0\text{ ms} \pm 2\text{ ms}\) over Modbus TCP. Any packet arrival with high jitter, non-standard transaction IDs, or irregular payload sizes is an immediate forensic anomaly.
  2. Read vs. Write Function Codes: Normal supervisory SCADA traffic consists almost entirely of read operations (e.g., Modbus Function Code 0x03 - Read Holding Registers). An unauthorized write command (e.g., Modbus Function Code 0x06 - Write Single Register or 0x10 - Write Multiple Registers) attempting to modify centrifuge speeds or valve limits represents a critical physical attack (e.g., Stuxnet or Industroyer2 tradecraft).
  3. Engineering Workstation Firmware Uploads: Unauthorized invocation of proprietary diagnostic functions (such as Siemens S7comm Download Block or Stop CPU) from an IP address other than the designated, audited engineering console.

Cloud, Multi-Cloud, and Containerized Forensics

In cloud environments (AWS, Azure, GCP) and container orchestrators (Kubernetes), traditional network visibility (physical taps and switch SPAN ports) does not exist. Network forensics must adapt to virtualized, software-defined fabrics:

1. Ephemeral IP Addresses and Identity Disconnects

In Kubernetes, pods terminate and spawn within seconds, recycling IP addresses. If an incident occurred at 10:14:22, an alert referencing IP 10.244.2.84 is useless without correlating the IP to the exact Pod UID, Namespace, and Container Image running at that precise microsecond: - Kubernetes Audit Logs: Correlating network flows against API server audit trails (requestURI: /api/v1/namespaces/prod/pods). - Cilium eBPF Tetragon: Capturing kernel-level network socket events enriched with Kubernetes container metadata directly at socket creation.

2. Cloud Control Plane Forensics

Adversaries in cloud networks rarely pivot through physical cables; they pivot through the control plane: - Inspecting AWS CloudTrail or Azure Activity logs for AuthorizeSecurityGroupIngress, CreateVpcPeeringConnection, or ModifyNetworkInterfaceAttribute. - VPC Flow Logs capturing communication with unusual internal metadata services (169.254.169.254 IMDSv1 queries attempting SSRF token theft).

Internet of Things (IoT) and Smart Cities

Smart cities deploy millions of constrained sensors across traffic control, automated metering, public surveillance, and environmental monitoring:

  • Lightweight Protocols: IoT devices communicate via MQTT, CoAP, or lightweight REST over UDP/DTLS.
  • Botnet Enlistment (Mirai / Mozi Archetype): IoT devices are targeted for recruitment into massive DDoS botnets. Forensic behavioral indicators include:
    • Spikes in outbound TCP port 23 (Telnet), 22 (SSH), or 2323 sweeps with hardcoded default credentials.
    • Abrupt shifts in DNS querying behavior from local NTP/manufacturer gateways to public resolvers (8.8.8.8, 1.1.1.1).
    • High-volume outbound UDP/GRE floods originating from low-power microcontroller MAC addresses.

Healthcare and Medical Devices (IoMT)

Hospital networks host Internet of Medical Things (IoMT) hardware: infusion pumps, patient monitors, MRI/CT scanners, and surgical robotics.

  • Vulnerable Legacy Stacks: Many IoMT devices run embedded, unpatchable legacy operating systems (Windows XP Embedded, legacy VxWorks).
  • Protocol Specifics: Traffic revolves around DICOM (medical imaging) and HL7 (patient health records).
  • Forensic Behavioral Constraints: Active vulnerability scanning (e.g., aggressive Nmap scans) can crash sensitive infusion pumps or disrupt heart-rate monitors. Forensic evidence must be gathered purely out-of-band via passive network taps and statistical flow inspection.
Domain Key Network Protocols High-Risk Behavioral Indicators Primary Telemetry Sources
ICS / SCADA Modbus TCP, DNP3, IEC 60870-5-104, S7comm Non-standard Function Codes, PLC stop commands, high timing jitter Industrial network taps, Historian logs, PLC audit buffers
Cloud / K8s CNI overlays (Geneve, VXLAN), Envoy gRPC Metadata service SSRF queries, egress to unmapped cloud buckets VPC Flow Logs, Cilium eBPF, K8s API audit logs
IoT / Smart Cities MQTT, CoAP, LoRaWAN, Zigbee Outbound credential brute-force, unexpected firmware download Gateway packet captures, MQTT broker access logs
IoMT / Healthcare DICOM (TCP 104), HL7, proprietary telemetry Bulk DICOM exfiltration, unencrypted patient record transfer Passive SPAN captures, Medical Device Integration engines

Chapter Summary

  • Operational technology (OT/ICS) networks demand extreme timing determinism; unauthorized write function codes signal direct threats to physical safety.
  • Cloud and container forensics requires synchronizing ephemeral IP lifecycles with container identities and control plane audit logs (CloudTrail, K8s API).
  • IoT networks reveal botnet staging through sudden shifts from lightweight telemetry to outbound port sweeps and high-volume UDP floods.
  • Medical device forensics must operate strictly out-of-band to prevent active scanning tools from destabilizing critical patient-care systems.