Threat ID 31671 - SCADA ICCP Unauthorized COTP Connection Established

K.Nand — Thu, 05 Jun 2025 00:49:39 GMT

I think the description of "Threat ID: 31671 - SCADA ICCP Unauthorized COTP Connection Established" is incorrect. Below is the description of the Threat, but it describes a successful connection there doesn't seem to be anything malicious to it. I'm thinking more should have been added to the description to describe why the threat is malicious.

"SCADA is the abbreviation for Supervisory Control And Data Acquisition. It generally refers to an industrial control system: a computer system monitoring and controlling a process. This alert indicates that an ICCP client has successfully connected using OSI Connection Oriented Transport Protocol."

Re: Threat ID 31671 - SCADA ICCP Unauthorized COTP Connection Established

kiwi — Tue, 09 Sep 2025 09:10:12 GMT

Hi @K.Nand ,

The threat isn't the connection itself; it's the fact that the connection is unauthorized. The alert is telling you that a connection was successfully established to a sensitive SCADA system by a source that should not be making that connection.

Kind regards,

-Kim.

topic Threat ID 31671 - SCADA ICCP Unauthorized COTP Connection Established in Advanced Threat Prevention Discussions

Threat ID 31671 - SCADA ICCP Unauthorized COTP Connection Established

Re: Threat ID 31671 - SCADA ICCP Unauthorized COTP Connection Established