Why OT attacks don't (usually) have signatures
Signature-based detection is simple, and it works — against a threat someone has already seen, named, and written a rule for. That covers a lot of run-of-the-mill IT malware. It covers far less of what actually hurts an industrial network.
What signatures catch
Some OT attacks do have signatures. The notorious ICS malware — TRITON/TRISIS, Industroyer, PIPEDREAM — has been picked apart, and rules exist to spot it. If known malware were your only problem, signatures would carry you a long way.
What they miss
The trouble is that the attacks most likely to knock you offline rarely look like known malware:
- The new and the never-seen. A zero-day, by definition, has no signature waiting for it.
- The insider. An engineer — or a workstation that’s been quietly taken over — doing something it’s technically allowed to do, at the wrong time or in the wrong place.
- A legitimate command with a darker purpose. A perfectly valid Modbus write or S7 job, sent by a device that should never send one. There’s nothing malformed to match.
And even for known threats, no signature library keeps pace with thousands of bespoke control networks — each with its own equipment, vintages, and quirks.
A different question
Behavioural detection asks a different question. Instead of “have I seen this exact attack before?”, it asks “is this normal for this network?” — and “is this what a healthy OT network should look like?”
That’s the approach Maigadi takes: it learns your network’s normal, applies what a well-run OT network should look like, and flags what doesn’t fit — with the evidence to back every alert. No rule to write. No signature to wait for.