Skip to content

v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Oct 18:26
· 29 commits to main since this release
v0.2.0
672ac28

Seeds are not stable across versions: the same seed can give a different exercise than in 0.1.0.

Scenarios

  • ot-modbus-discovery: port-502 sweep, device identification and register-map enumeration, no writes.
  • ot-modbus-command-replay: an unapproved host replays operator commands; every value stays in band.
  • ot-modbus-coil-manipulation: coil writes force actuators, with alarm acknowledgement on medium/hard.
  • ot-modbus-alarm-masking: an alarm threshold is moved out of band before the setpoint it guards.
  • ot-baseline-operations: normal operations only, for baselining and false-positive tuning.

Traffic realism

  • Background protocols on medium/hard: IEC 60870-5-104, DNP3, BACnet/IP and EtherNet/IP (explicit
    messaging and class 1 I/O), each with SIEM datasets and detection rules.
  • DHCPv4 end to end, TCP segmentation, SPAN artefacts (VLAN, duplicates, sensor drops) and host
    firewalls (filtered vs closed ports).
  • IPv6: link-local baseline, Router Advertisements, SLAAC and Neighbor Discovery; a dual-stack site on
    hard, including the embedded Linux controllers.
  • Process models: FLOAT32 points across two registers, register descriptions, vendor register numbering
    in the handout, more PLC vendors.
  • Long captures stream through compose, verify and export: a 24 h hard run peaks at 0.93 GB.

Training workflow

  • pcapforge ui: local web UI for generation, class batches, run pages (network map, traffic chart,
    timeline, answer key, downloads per section) and the run actions; --student mode with answer forms,
    a class roster and access codes.
  • pcapforge report: self-contained HTML debrief with process charts and class results.
  • pcapforge export-ctfd: one CTFd challenge per question.
  • Hints cost 20 % of a question's points when listed under hints_used.
  • German (--lang de) next to Polish.

Detection engineering

  • Sigma rules over the SIEM export, with correlation rules for port sweeps and command replay.
  • Suricata band rules for FLOAT32 setpoints.
  • --zeek: deterministic Zeek JSON logs from a local Zeek, a Zeek in WSL (Windows) or the Docker image.

Fixes and docs

  • pymodbus pinned to 3.15.x: 3.16.0 cannot be imported without pyserial.
  • MkDocs documentation site; the README is short, the details are in docs/.

Sample captures

Generated with --seed release, two zips per scenario and difficulty:

  • <run>-student.zip: capture.pcap, briefing.md (handout) and submission_template.yaml
    (fill it in, then grade it with pcapforge grade answers.json <submission>).
  • <run>-instructor.zip: the whole run, including answers.json, siem/ and detections/.
    Keep it away from students.
Assets 38
Loading