[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GXD8QSRB41APGD5JSF324F":3,"skill-same:01M6GXD8QSRB41APGD5JSF324F":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":55,"install":56,"resources":69},"01M6GXD8QSRB41APGD5JSF324F","detecting-attacks-on-historian-servers",null,"Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, Wonderware) that sit at the IT\u002FOT boundary and serve as pivot points for lateral movement between enterprise and control networks, including data manipulation, unauthorized queries, and exploitation of historian-specific vulnerabilities.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-attacks-on-historian-servers\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"attacks","detecting","historian","detecting attacks on historian servers","targeting","cybersecurity","as","data manipulation","queries","pi","boundary","networks","data-integrity","pivot-point","ignition","osisoft-pi","ics","ot-security","exploitation","Enterprise","2026-11-10 10:12:30",false,"---\nname: detecting-attacks-on-historian-servers\ndescription: >\n  Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition,\n  Wonderware) that sit at the IT\u002FOT boundary and serve as pivot points for\n  lateral movement between enterprise and control networks, including data\n  manipulation, unauthorized queries, and exploitation of historian-specific\n  vulnerabilities.\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags: [ot-security, ics, historian, osisoft-pi, ignition, pivot-point, data-integrity, lateral-movement]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Detecting Attacks on Historian Servers\n\n## When to Use\n\n- When monitoring historian servers that bridge IT and OT networks for compromise indicators\n- When detecting unauthorized queries or data manipulation in process historian databases\n- When investigating lateral movement through historian servers between IT and OT zones\n- When responding to alerts about exploitation of historian-specific vulnerabilities (CVE-2025-0921)\n- When validating historian data integrity after a suspected OT security incident\n\n**Do not use** for general database security monitoring (see database security skills), for historian deployment and configuration, or for IT-only data warehouse security.\n\n## Prerequisites\n\n- Historian server inventory (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL)\n- Network monitoring on historian network segments (both IT-facing and OT-facing interfaces)\n- Historian API access for data integrity validation\n- Baseline of normal historian query patterns (which applications query which tags)\n- Understanding of historian architecture (data sources, interfaces, client connections)\n\n## Workflow\n\n### Step 1: Monitor Historian for Attack Indicators\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Historian Attack Detector.\n\nMonitors historian servers for unauthorized access, data manipulation,\nlateral movement indicators, and exploitation of historian-specific\nvulnerabilities. Supports OSIsoft PI and Ignition platforms.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom datetime import datetime, timedelta\nfrom typing import Dict, List, Optional\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass HistorianAttackDetector:\n    \"\"\"Detects attacks targeting OT historian servers.\"\"\"\n\n    def __init__(self, historian_type: str, historian_url: str,\n                 api_credentials: dict, verify_ssl: bool = False):\n        self.historian_type = historian_type\n        self.historian_url = historian_url.rstrip(\"\u002F\")\n        self.credentials = api_credentials\n        self.verify_ssl = verify_ssl\n        self.alerts = []\n        self.authorized_clients = set()\n        self.authorized_queries = {}\n\n    def set_baseline(self, authorized_clients: List[str],\n                     authorized_query_patterns: Dict[str, List[str]]):\n        \"\"\"Set baseline of authorized historian clients and query patterns.\"\"\"\n        self.authorized_clients = set(authorized_clients)\n        self.authorized_queries = authorized_query_patterns\n\n    def check_active_connections(self) -> List[dict]:\n        \"\"\"Check for unauthorized connections to historian.\"\"\"\n        connections = []\n\n        if self.historian_type == \"osisoft_pi\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fpiwebapi\u002Fsystem\u002Fstatus\",\n                    auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    data = resp.json()\n                    connections = data.get(\"ConnectedClients\", [])\n            except requests.RequestException as e:\n                print(f\"[!] PI Web API error: {e}\")\n\n        elif self.historian_type == \"ignition\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fdata\u002Fstatus\u002Fconnections\",\n                    headers={\"Authorization\": f\"Bearer {self.credentials.get('token')}\"},\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    connections = resp.json().get(\"connections\", [])\n            except requests.RequestException as e:\n                print(f\"[!] Ignition API error: {e}\")\n\n        # Check for unauthorized clients\n        for conn in connections:\n            client_ip = conn.get(\"client_ip\", conn.get(\"address\", \"\"))\n            if self.authorized_clients and client_ip not in self.authorized_clients:\n                self.alerts.append({\n                    \"severity\": \"HIGH\",\n                    \"type\": \"UNAUTHORIZED_HISTORIAN_CLIENT\",\n                    \"timestamp\": datetime.now().isoformat(),\n                    \"source_ip\": client_ip,\n                    \"details\": f\"Unauthorized client {client_ip} connected to {self.historian_type} historian\",\n                    \"mitre\": \"T0802 - Automated Collection\",\n                })\n\n        return connections\n\n    def check_data_integrity(self, tags: List[str], hours_back: int = 24):\n        \"\"\"Check historian data for manipulation indicators.\"\"\"\n        print(f\"[*] Checking data integrity for {len(tags)} tags over last {hours_back}h\")\n\n        integrity_issues = []\n        for tag in tags:\n            try:\n                if self.historian_type == \"osisoft_pi\":\n                    resp = requests.get(\n                        f\"{self.historian_url}\u002Fpiwebapi\u002Fstreams\u002F{tag}\u002Frecorded\",\n                        params={\"startTime\": f\"*-{hours_back}h\", \"endTime\": \"*\"},\n                        auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                        verify=self.verify_ssl,\n                        timeout=15,\n                    )\n                    if resp.status_code == 200:\n                        items = resp.json().get(\"Items\", [])\n                        # Check for suspicious patterns\n                        if len(items) == 0:\n                            integrity_issues.append({\n                                \"tag\": tag, \"issue\": \"NO_DATA\",\n                                \"detail\": \"No data points in expected timeframe - possible deletion\",\n                            })\n                        else:\n                            values = [i.get(\"Value\", 0) for i in items if isinstance(i.get(\"Value\"), (int, float))]\n                            if values and len(set(values)) == 1 and len(values) > 100:\n                                integrity_issues.append({\n                                    \"tag\": tag, \"issue\": \"FLATLINE\",\n                                    \"detail\": f\"Constant value {values[0]} for {len(values)} points - possible replay\u002Fspoofing\",\n                                })\n            except requests.RequestException:\n                pass\n\n        for issue in integrity_issues:\n            self.alerts.append({\n                \"severity\": \"HIGH\",\n                \"type\": f\"DATA_INTEGRITY_{issue['issue']}\",\n                \"timestamp\": datetime.now().isoformat(),\n                \"tag\": issue[\"tag\"],\n                \"details\": issue[\"detail\"],\n                \"mitre\": \"T0809 - Data Destruction\" if issue[\"issue\"] == \"NO_DATA\" else \"T0832 - Manipulation of View\",\n            })\n\n        return integrity_issues\n\n    def check_lateral_movement_indicators(self):\n        \"\"\"Check for indicators of historian being used as pivot point.\"\"\"\n        indicators = []\n\n        # Check 1: Historian making outbound connections to Level 1 devices\n        # (Historian should receive data, not initiate connections to PLCs)\n        indicators.append({\n            \"check\": \"Outbound connections to PLC subnets\",\n            \"description\": \"Historian initiating connections to Level 1 devices may indicate compromise\",\n            \"detection\": \"Monitor firewall logs for historian IP connecting to PLC ports (502, 102, 44818)\",\n        })\n\n        # Check 2: New processes or services on historian\n        indicators.append({\n            \"check\": \"Unauthorized processes on historian server\",\n            \"description\": \"Attackers may install tools on historian for lateral movement\",\n            \"detection\": \"Monitor process creation events (Sysmon EventID 1) on historian\",\n        })\n\n        # Check 3: Unusual authentication to historian\n        indicators.append({\n            \"check\": \"Authentication from unexpected sources\",\n            \"description\": \"Compromised IT systems authenticating to historian for pivoting\",\n            \"detection\": \"Monitor Windows Security Event 4624 for logons from non-baseline sources\",\n        })\n\n        return indicators\n\n    def generate_report(self):\n        \"\"\"Generate historian attack detection report.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(\"HISTORIAN ATTACK DETECTION REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Historian Type: {self.historian_type}\")\n        print(f\"Historian URL: {self.historian_url}\")\n        print(f\"Report Time: {datetime.now().isoformat()}\")\n        print(f\"Total Alerts: {len(self.alerts)}\")\n\n        if self.alerts:\n            print(f\"\\n--- ALERTS ---\")\n            for alert in self.alerts:\n                print(f\"\\n  [{alert['severity']}] {alert['type']}\")\n                print(f\"    Time: {alert['timestamp']}\")\n                print(f\"    Detail: {alert['details']}\")\n                print(f\"    MITRE ICS: {alert.get('mitre', 'N\u002FA')}\")\n\n        print(f\"\\n--- LATERAL MOVEMENT CHECKS ---\")\n        for indicator in self.check_lateral_movement_indicators():\n            print(f\"\\n  Check: {indicator['check']}\")\n            print(f\"    Risk: {indicator['description']}\")\n            print(f\"    Detection: {indicator['detection']}\")\n\n\nif __name__ == \"__main__\":\n    detector = HistorianAttackDetector(\n        historian_type=\"osisoft_pi\",\n        historian_url=\"https:\u002F\u002Fpi-server.plant.local\",\n        api_credentials={\"username\": \"pi_reader\", \"password\": \"api_key_here\"},\n    )\n\n    detector.set_baseline(\n        authorized_clients=[\"10.10.2.10\", \"10.10.2.20\", \"10.10.3.50\", \"10.10.150.10\"],\n        authorized_query_patterns={},\n    )\n\n    detector.check_active_connections()\n    detector.check_data_integrity(tags=[\"REACTOR_01.TEMP\", \"PUMP_03.FLOW\"], hours_back=24)\n    detector.generate_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| OT Historian | Database server (OSIsoft PI, Ignition, Wonderware) storing time-series process data from SCADA\u002FDCS systems |\n| Pivot Point | Historian's position between IT and OT networks makes it a prime target for attackers to move between zones |\n| Data Replay Attack | Feeding historical data to an HMI to mask real-time process manipulation (Stuxnet technique) |\n| OSIsoft PI | Most widely deployed OT historian, used by 65% of Global 500 process companies |\n| Ignition | Inductive Automation SCADA platform with historian module, increasingly targeted due to Python scripting capabilities |\n| CVE-2025-0921 | Ignition SCADA privileged file system vulnerability allowing escalation through malicious project files |\n\n## Output Format\n\n```\nHISTORIAN ATTACK DETECTION REPORT\n====================================\nHistorian: [type and hostname]\nDate: YYYY-MM-DD\n\nCONNECTION ANALYSIS:\n  Authorized Clients: [count]\n  Unauthorized Clients Detected: [count with IPs]\n\nDATA INTEGRITY:\n  Tags Checked: [count]\n  Integrity Issues: [count]\n  Flatline Detections: [count]\n  Data Gaps: [count]\n\nLATERAL MOVEMENT INDICATORS:\n  Outbound PLC Connections: [found\u002Fnot found]\n  Unauthorized Processes: [found\u002Fnot found]\n  Anomalous Authentication: [found\u002Fnot found]\n```\n","# Detecting Attacks on Historian Servers\n\n## When to Use\n\n- When monitoring historian servers that bridge IT and OT networks for compromise indicators\n- When detecting unauthorized queries or data manipulation in process historian databases\n- When investigating lateral movement through historian servers between IT and OT zones\n- When responding to alerts about exploitation of historian-specific vulnerabilities (CVE-2025-0921)\n- When validating historian data integrity after a suspected OT security incident\n\n**Do not use** for general database security monitoring (see database security skills), for historian deployment and configuration, or for IT-only data warehouse security.\n\n## Prerequisites\n\n- Historian server inventory (OSIsoft PI, Ignition, GE Proficy, Wonderware InSQL)\n- Network monitoring on historian network segments (both IT-facing and OT-facing interfaces)\n- Historian API access for data integrity validation\n- Baseline of normal historian query patterns (which applications query which tags)\n- Understanding of historian architecture (data sources, interfaces, client connections)\n\n## Workflow\n\n### Step 1: Monitor Historian for Attack Indicators\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Historian Attack Detector.\n\nMonitors historian servers for unauthorized access, data manipulation,\nlateral movement indicators, and exploitation of historian-specific\nvulnerabilities. Supports OSIsoft PI and Ignition platforms.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom datetime import datetime, timedelta\nfrom typing import Dict, List, Optional\n\ntry:\n    import requests\nexcept ImportError:\n    print(\"Install requests: pip install requests\")\n    sys.exit(1)\n\n\nclass HistorianAttackDetector:\n    \"\"\"Detects attacks targeting OT historian servers.\"\"\"\n\n    def __init__(self, historian_type: str, historian_url: str,\n                 api_credentials: dict, verify_ssl: bool = False):\n        self.historian_type = historian_type\n        self.historian_url = historian_url.rstrip(\"\u002F\")\n        self.credentials = api_credentials\n        self.verify_ssl = verify_ssl\n        self.alerts = []\n        self.authorized_clients = set()\n        self.authorized_queries = {}\n\n    def set_baseline(self, authorized_clients: List[str],\n                     authorized_query_patterns: Dict[str, List[str]]):\n        \"\"\"Set baseline of authorized historian clients and query patterns.\"\"\"\n        self.authorized_clients = set(authorized_clients)\n        self.authorized_queries = authorized_query_patterns\n\n    def check_active_connections(self) -> List[dict]:\n        \"\"\"Check for unauthorized connections to historian.\"\"\"\n        connections = []\n\n        if self.historian_type == \"osisoft_pi\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fpiwebapi\u002Fsystem\u002Fstatus\",\n                    auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    data = resp.json()\n                    connections = data.get(\"ConnectedClients\", [])\n            except requests.RequestException as e:\n                print(f\"[!] PI Web API error: {e}\")\n\n        elif self.historian_type == \"ignition\":\n            try:\n                resp = requests.get(\n                    f\"{self.historian_url}\u002Fdata\u002Fstatus\u002Fconnections\",\n                    headers={\"Authorization\": f\"Bearer {self.credentials.get('token')}\"},\n                    verify=self.verify_ssl,\n                    timeout=10,\n                )\n                if resp.status_code == 200:\n                    connections = resp.json().get(\"connections\", [])\n            except requests.RequestException as e:\n                print(f\"[!] Ignition API error: {e}\")\n\n        # Check for unauthorized clients\n        for conn in connections:\n            client_ip = conn.get(\"client_ip\", conn.get(\"address\", \"\"))\n            if self.authorized_clients and client_ip not in self.authorized_clients:\n                self.alerts.append({\n                    \"severity\": \"HIGH\",\n                    \"type\": \"UNAUTHORIZED_HISTORIAN_CLIENT\",\n                    \"timestamp\": datetime.now().isoformat(),\n                    \"source_ip\": client_ip,\n                    \"details\": f\"Unauthorized client {client_ip} connected to {self.historian_type} historian\",\n                    \"mitre\": \"T0802 - Automated Collection\",\n                })\n\n        return connections\n\n    def check_data_integrity(self, tags: List[str], hours_back: int = 24):\n        \"\"\"Check historian data for manipulation indicators.\"\"\"\n        print(f\"[*] Checking data integrity for {len(tags)} tags over last {hours_back}h\")\n\n        integrity_issues = []\n        for tag in tags:\n            try:\n                if self.historian_type == \"osisoft_pi\":\n                    resp = requests.get(\n                        f\"{self.historian_url}\u002Fpiwebapi\u002Fstreams\u002F{tag}\u002Frecorded\",\n                        params={\"startTime\": f\"*-{hours_back}h\", \"endTime\": \"*\"},\n                        auth=(self.credentials.get(\"username\"), self.credentials.get(\"password\")),\n                        verify=self.verify_ssl,\n                        timeout=15,\n                    )\n                    if resp.status_code == 200:\n                        items = resp.json().get(\"Items\", [])\n                        # Check for suspicious patterns\n                        if len(items) == 0:\n                            integrity_issues.append({\n                                \"tag\": tag, \"issue\": \"NO_DATA\",\n                                \"detail\": \"No data points in expected timeframe - possible deletion\",\n                            })\n                        else:\n                            values = [i.get(\"Value\", 0) for i in items if isinstance(i.get(\"Value\"), (int, float))]\n                            if values and len(set(values)) == 1 and len(values) > 100:\n                                integrity_issues.append({\n                                    \"tag\": tag, \"issue\": \"FLATLINE\",\n                                    \"detail\": f\"Constant value {values[0]} for {len(values)} points - possible replay\u002Fspoofing\",\n                                })\n            except requests.RequestException:\n                pass\n\n        for issue in integrity_issues:\n            self.alerts.append({\n                \"severity\": \"HIGH\",\n                \"type\": f\"DATA_INTEGRITY_{issue['issue']}\",\n                \"timestamp\": datetime.now().isoformat(),\n                \"tag\": issue[\"tag\"],\n                \"details\": issue[\"detail\"],\n                \"mitre\": \"T0809 - Data Destruction\" if issue[\"issue\"] == \"NO_DATA\" else \"T0832 - Manipulation of View\",\n            })\n\n        return integrity_issues\n\n    def check_lateral_movement_indicators(self):\n        \"\"\"Check for indicators of historian being used as pivot point.\"\"\"\n        indicators = []\n\n        # Check 1: Historian making outbound connections to Level 1 devices\n        # (Historian should receive data, not initiate connections to PLCs)\n        indicators.append({\n            \"check\": \"Outbound connections to PLC subnets\",\n            \"description\": \"Historian initiating connections to Level 1 devices may indicate compromise\",\n            \"detection\": \"Monitor firewall logs for historian IP connecting to PLC ports (502, 102, 44818)\",\n        })\n\n        # Check 2: New processes or services on historian\n        indicators.append({\n            \"check\": \"Unauthorized processes on historian server\",\n            \"description\": \"Attackers may install tools on historian for lateral movement\",\n            \"detection\": \"Monitor process creation events (Sysmon EventID 1) on historian\",\n        })\n\n        # Check 3: Unusual authentication to historian\n        indicators.append({\n            \"check\": \"Authentication from unexpected sources\",\n            \"description\": \"Compromised IT systems authenticating to historian for pivoting\",\n            \"detection\": \"Monitor Windows Security Event 4624 for logons from non-baseline sources\",\n        })\n\n        return indicators\n\n    def generate_report(self):\n        \"\"\"Generate historian attack detection report.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(\"HISTORIAN ATTACK DETECTION REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Historian Type: {self.historian_type}\")\n        print(f\"Historian URL: {self.historian_url}\")\n        print(f\"Report Time: {datetime.now().isoformat()}\")\n        print(f\"Total Alerts: {len(self.alerts)}\")\n\n        if self.alerts:\n            print(f\"\\n--- ALERTS ---\")\n            for alert in self.alerts:\n                print(f\"\\n  [{alert['severity']}] {alert['type']}\")\n                print(f\"    Time: {alert['timestamp']}\")\n                print(f\"    Detail: {alert['details']}\")\n                print(f\"    MITRE ICS: {alert.get('mitre', 'N\u002FA')}\")\n\n        print(f\"\\n--- LATERAL MOVEMENT CHECKS ---\")\n        for indicator in self.check_lateral_movement_indicators():\n            print(f\"\\n  Check: {indicator['check']}\")\n            print(f\"    Risk: {indicator['description']}\")\n            print(f\"    Detection: {indicator['detection']}\")\n\n\nif __name__ == \"__main__\":\n    detector = HistorianAttackDetector(\n        historian_type=\"osisoft_pi\",\n        historian_url=\"https:\u002F\u002Fpi-server.plant.local\",\n        api_credentials={\"username\": \"pi_reader\", \"password\": \"api_key_here\"},\n    )\n\n    detector.set_baseline(\n        authorized_clients=[\"10.10.2.10\", \"10.10.2.20\", \"10.10.3.50\", \"10.10.150.10\"],\n        authorized_query_patterns={},\n    )\n\n    detector.check_active_connections()\n    detector.check_data_integrity(tags=[\"REACTOR_01.TEMP\", \"PUMP_03.FLOW\"], hours_back=24)\n    detector.generate_report()\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| OT Historian | Database server (OSIsoft PI, Ignition, Wonderware) storing time-series process data from SCADA\u002FDCS systems |\n| Pivot Point | Historian's position between IT and OT networks makes it a prime target for attackers to move between zones |\n| Data Replay Attack | Feeding historical data to an HMI to mask real-time process manipulation (Stuxnet technique) |\n| OSIsoft PI | Most widely deployed OT historian, used by 65% of Global 500 process companies |\n| Ignition | Inductive Automation SCADA platform with historian module, increasingly targeted due to Python scripting capabilities |\n| CVE-2025-0921 | Ignition SCADA privileged file system vulnerability allowing escalation through malicious project files |\n\n## Output Format\n\n```\nHISTORIAN ATTACK DETECTION REPORT\n====================================\nHistorian: [type and hostname]\nDate: YYYY-MM-DD\n\nCONNECTION ANALYSIS:\n  Authorized Clients: [count]\n  Unauthorized Clients Detected: [count with IPs]\n\nDATA INTEGRITY:\n  Tags Checked: [count]\n  Integrity Issues: [count]\n  Flatline Detections: [count]\n  Data Gaps: [count]\n\nLATERAL MOVEMENT INDICATORS:\n  Outbound PLC Connections: [found\u002Fnot found]\n  Unauthorized Processes: [found\u002Fnot found]\n  Anomalous Authentication: [found\u002Fnot found]\n```\n",{"name":5,"tags":43,"author":45,"domain":23,"license":14,"version":46,"subdomain":47,"description":48},[35,34,20,33,32,31,30,44],"lateral-movement","mahipal","1.0","ot-ics-security","Detect cyber attacks targeting OT historian servers (OSIsoft PI, Ignition, Wonderware) that sit at the IT\u002FOT boundary and serve as pivot points for lateral movement between enterprise and control networks, including data manipulation, unauthorized queries, and exploitation of historian-specific vulnerabilities.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-attacks-on-historian-servers",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add micsapp\u002Fmicstec-skills --skill detecting-attacks-on-historian-servers",{"tool":62,"command":63},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill detecting-attacks-on-historian-servers",{"tool":65,"command":66},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill detecting-attacks-on-historian-servers","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-attacks-on-historian-servers\u002FSKILL.md",true,[70,75,81],{"path":71,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-attacks-on-historian-servers\u002FLICENSE",{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"references\u002Fapi-reference.md","REFERENCE","参考文档",1954,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-attacks-on-historian-servers\u002Freferences\u002Fapi-reference.md",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"scripts\u002Fagent.py","SCRIPT","脚本",7180,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-attacks-on-historian-servers\u002Fscripts\u002Fagent.py",[88,126,155,176,196,221],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":105,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[95,100],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":140,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[132,133,136,139],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},{"categoryNo":134,"categoryName":135,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":137,"categoryName":138,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},[141,142,143,144,107,145,146,147,148,149,150,151,115,116,122,24,152,123,153,154],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","guides","CI\u002FCD","implementing",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[161],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},[163,164,165,166,107,110,115,116,167,168,169,170,171,172,173,123,174,175,154,125],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":184,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[182,183],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},[185,166,186,115,170,187,107,141,188,189,190,191,116,192,123,193,194,195,124,125],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[203,204,205,143,206,207,208,209,115,210,211,212,213,214,215,216,217,218,219,220],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":227,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[223,228,229,230,231,232,233,168,234,235],"npm","js","calculate","node","math","user","compute","errors"]