[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DT5RVQ48WB6JHJTEEASPW":3,"skill-same:01M71DT5RVQ48WB6JHJTEEASPW":99},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":72,"commitSha":73,"skillDirectory":74,"forksCount":14,"repositoryHtmlUrl":75,"repositoryHomepageUrl":6,"ownerHtmlUrl":76,"ownerBlogUrl":6,"ownerDescription":77,"updatedAt":78,"install":79,"resources":92},"01M71DT5RVQ48WB6JHJTEEASPW","ics-vulnerability-patch-manage-harden",null,"This skill covers implementing a structured patch management program for OT\u002FICS environments where traditional IT patching approaches can cause process disruption or safety hazards. It addresses vendor compatibility testing, risk-based patch prioritization, staged deployment through test environments, maintenance window coordination, rollback procedures, and compensating controls when patches cannot be applied due to operational constraints or vendor restrictions.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fvulnerability\u002Fpatch\u002Fmanage\u002Fharden\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"patch","ics vulnerability patch manage harden","harden","manage","vulnerability","ics","prioritization","Bash","coordination","cm","testing","vulnerability-management","patch-management","implementing","window","operational constraints","2024","when","program","cybersecurity","2026-11-10 10:12:30",false,"---\nname: ics-vulnerability-patch-manage-harden\ndescription: This skill covers implementing a structured patch management program for OT\u002FICS environments where traditional IT patching approaches can cause process disruption or safety hazards. It addresses vendor compatibility testing, risk-based patch prioritization, staged deployment through test environments, maintenance window coordination, rollback procedures, and compensating controls when patches cannot be applied due to operational constraints or vendor restrictions.\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- scada\n- industrial-control\n- iec62443\n- patch-management\n- vulnerability-management\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T0855\ncve:\n- CVE-2023-44374\n- CVE-2024-21914\ncapec: []\n---\n\n# Implementing Patch Management for OT Systems\n\n## When to Use\n\n- When establishing a formal OT patch management program for the first time\n- When responding to critical ICS-CERT advisories affecting deployed OT systems\n- When preparing for NERC CIP-007-6 or IEC 62443 patch management compliance audits\n- When planning patch deployment during limited maintenance windows in continuous operations\n- When evaluating compensating controls for systems that cannot be patched\n\n**Do not use** for IT-only patch management without OT considerations, for emergency patching during active cyber incidents (see performing-ot-incident-response), or for firmware upgrades that change PLC functionality (requires separate change management).\n\n## Prerequisites\n\n- OT asset inventory with firmware\u002FOS versions for all patchable systems\n- Vendor patch notification subscriptions (Siemens ProductCERT, Rockwell, Schneider, etc.)\n- Test\u002Fstaging environment mirroring production OT systems for patch validation\n- Maintenance window schedule aligned with process shutdowns and turnarounds\n- Change management board approval process including operations and safety representatives\n\n## Workflow\n\n### Step 1: Establish OT Patch Management Program\n\nDefine the patch management lifecycle adapted for OT environments where availability and safety take priority over immediate vulnerability remediation.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Patch Management Program Manager.\n\nTracks patches for OT systems, manages risk-based prioritization,\ncoordinates testing and deployment, and documents compensating\ncontrols for unpatchable systems.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime, timedelta\nfrom enum import Enum\n\n\nclass PatchStatus(str, Enum):\n    IDENTIFIED = \"identified\"\n    EVALUATING = \"evaluating\"\n    TESTING = \"testing\"\n    APPROVED = \"approved\"\n    SCHEDULED = \"scheduled\"\n    DEPLOYED = \"deployed\"\n    DEFERRED = \"deferred\"\n    NOT_APPLICABLE = \"not_applicable\"\n\n\n@dataclass\nclass OTPatch:\n    patch_id: str\n    vendor: str\n    product: str\n    affected_versions: str\n    cve_ids: list\n    cvss_score: float\n    ics_cert_advisory: str\n    description: str\n    status: str = PatchStatus.IDENTIFIED\n    identified_date: str = \"\"\n    evaluation_deadline: str = \"\"  # 35 days per CIP-007\n    test_date: str = \"\"\n    deployment_date: str = \"\"\n    affected_assets: list = field(default_factory=list)\n    test_results: str = \"\"\n    compensating_controls: str = \"\"\n    risk_rating: str = \"\"\n    maintenance_window: str = \"\"\n    rollback_procedure: str = \"\"\n\n\nclass OTPatchManager:\n    \"\"\"Manages the OT patch lifecycle.\"\"\"\n\n    def __init__(self):\n        self.patches = []\n        self.assets = {}\n        self.vendor_feeds = {}\n\n    def add_patch(self, patch: OTPatch):\n        \"\"\"Register a new patch for tracking.\"\"\"\n        # Set evaluation deadline (35 calendar days per NERC CIP-007)\n        if not patch.evaluation_deadline:\n            identified = datetime.fromisoformat(patch.identified_date)\n            patch.evaluation_deadline = (identified + timedelta(days=35)).isoformat()\n\n        self.patches.append(patch)\n\n    def prioritize_patches(self):\n        \"\"\"Risk-based prioritization for OT patches.\"\"\"\n        for patch in self.patches:\n            if patch.status in (PatchStatus.DEPLOYED, PatchStatus.NOT_APPLICABLE):\n                continue\n\n            # OT-specific risk scoring\n            score = patch.cvss_score\n\n            # Increase priority for actively exploited vulnerabilities\n            if \"CISA KEV\" in patch.ics_cert_advisory:\n                score += 2.0\n\n            # Increase priority for network-exposed OT systems\n            for asset_id in patch.affected_assets:\n                asset = self.assets.get(asset_id, {})\n                if asset.get(\"network_exposed\"):\n                    score += 1.0\n                if asset.get(\"purdue_level\") in (\"Level 0-1\", \"Level 2\"):\n                    score += 1.5\n\n            score = min(score, 10.0)\n\n            if score >= 9.0:\n                patch.risk_rating = \"critical\"\n            elif score >= 7.0:\n                patch.risk_rating = \"high\"\n            elif score >= 4.0:\n                patch.risk_rating = \"medium\"\n            else:\n                patch.risk_rating = \"low\"\n\n    def get_patches_needing_evaluation(self):\n        \"\"\"Get patches approaching evaluation deadline.\"\"\"\n        now = datetime.now()\n        approaching = []\n        for patch in self.patches:\n            if patch.status == PatchStatus.IDENTIFIED:\n                deadline = datetime.fromisoformat(patch.evaluation_deadline)\n                days_remaining = (deadline - now).days\n                if days_remaining \u003C= 7:\n                    approaching.append((patch, days_remaining))\n        return sorted(approaching, key=lambda x: x[1])\n\n    def defer_patch(self, patch_id, reason, compensating_controls):\n        \"\"\"Defer a patch with documented compensating controls.\"\"\"\n        for patch in self.patches:\n            if patch.patch_id == patch_id:\n                patch.status = PatchStatus.DEFERRED\n                patch.compensating_controls = compensating_controls\n                patch.test_results = f\"Deferred: {reason}\"\n                break\n\n    def generate_report(self):\n        \"\"\"Generate patch management status report.\"\"\"\n        self.prioritize_patches()\n\n        report = []\n        report.append(\"=\" * 70)\n        report.append(\"OT PATCH MANAGEMENT STATUS REPORT\")\n        report.append(f\"Date: {datetime.now().isoformat()}\")\n        report.append(\"=\" * 70)\n\n        # Status summary\n        status_counts = defaultdict(int)\n        for p in self.patches:\n            status_counts[p.status] += 1\n\n        report.append(\"\\nPATCH STATUS SUMMARY:\")\n        for status, count in status_counts.items():\n            report.append(f\"  {status}: {count}\")\n\n        # Approaching deadlines\n        approaching = self.get_patches_needing_evaluation()\n        if approaching:\n            report.append(\"\\nAPPROACHING EVALUATION DEADLINES:\")\n            for patch, days in approaching:\n                report.append(f\"  [{patch.patch_id}] {patch.description} - {days} days remaining\")\n\n        # Critical\u002FHigh priority patches\n        urgent = [p for p in self.patches\n                  if p.risk_rating in (\"critical\", \"high\")\n                  and p.status not in (PatchStatus.DEPLOYED, PatchStatus.NOT_APPLICABLE)]\n        if urgent:\n            report.append(f\"\\nURGENT PATCHES ({len(urgent)}):\")\n            for p in urgent:\n                report.append(f\"  [{p.patch_id}] [{p.risk_rating.upper()}] {p.description}\")\n                report.append(f\"    CVEs: {', '.join(p.cve_ids)}\")\n                report.append(f\"    Status: {p.status}\")\n                report.append(f\"    Affected Assets: {len(p.affected_assets)}\")\n\n        # Deferred patches with compensating controls\n        deferred = [p for p in self.patches if p.status == PatchStatus.DEFERRED]\n        if deferred:\n            report.append(f\"\\nDEFERRED PATCHES ({len(deferred)}):\")\n            for p in deferred:\n                report.append(f\"  [{p.patch_id}] {p.description}\")\n                report.append(f\"    Reason: {p.test_results}\")\n                report.append(f\"    Compensating Controls: {p.compensating_controls}\")\n\n        return \"\\n\".join(report)\n\n\nif __name__ == \"__main__\":\n    manager = OTPatchManager()\n\n    # Example patches\n    manager.add_patch(OTPatch(\n        patch_id=\"OT-PATCH-001\",\n        vendor=\"Siemens\",\n        product=\"SIMATIC S7-1500\",\n        affected_versions=\"\u003C V3.0.1\",\n        cve_ids=[\"CVE-2023-44374\"],\n        cvss_score=8.8,\n        ics_cert_advisory=\"ICSA-23-348-01\",\n        description=\"S7-1500 memory corruption via crafted packets\",\n        identified_date=\"2026-01-15\",\n        affected_assets=[\"PLC-01\", \"PLC-02\", \"PLC-03\"],\n    ))\n\n    manager.add_patch(OTPatch(\n        patch_id=\"OT-PATCH-002\",\n        vendor=\"Rockwell Automation\",\n        product=\"FactoryTalk View SE\",\n        affected_versions=\"\u003C V13.0\",\n        cve_ids=[\"CVE-2024-21914\"],\n        cvss_score=7.5,\n        ics_cert_advisory=\"ICSA-24-046-02\",\n        description=\"FactoryTalk View remote code execution\",\n        identified_date=\"2026-02-01\",\n        affected_assets=[\"HMI-01\", \"HMI-02\"],\n    ))\n\n    print(manager.generate_report())\n```\n\n### Step 2: Test Patches in Staging Environment\n\nNever deploy patches directly to production OT systems. Use a test environment that mirrors production to validate patch compatibility.\n\n```yaml\n# OT Patch Testing Procedure\npatch_testing:\n  environment:\n    description: \"Staging lab mirroring production OT architecture\"\n    components:\n      - \"Virtual PLC simulators matching production firmware\"\n      - \"Test HMI stations with identical software versions\"\n      - \"Test historian with representative data\"\n      - \"Network configuration matching production VLANs\u002Ffirewalls\"\n\n  test_cases:\n    functional:\n      - \"PLC programs execute correctly after OS patch\"\n      - \"HMI displays update with correct process values\"\n      - \"Historian data collection continues uninterrupted\"\n      - \"Alarm and event handling functions properly\"\n      - \"Communication between PLCs maintains cycle time\"\n      - \"Safety system trip tests pass (if SIS affected)\"\n\n    performance:\n      - \"PLC scan time remains within acceptable limits (\u003C50ms increase)\"\n      - \"HMI screen refresh rate unchanged\"\n      - \"Historian collection interval maintained\"\n      - \"Network latency between zones unchanged\"\n\n    compatibility:\n      - \"Third-party applications function correctly\"\n      - \"OPC UA\u002FDA connections establish successfully\"\n      - \"Custom scripts and batch processes execute\"\n      - \"Backup and restore procedures work\"\n\n    rollback:\n      - \"System can be reverted to pre-patch state\"\n      - \"Rollback procedure documented and tested\"\n      - \"Estimated rollback time: [N] minutes\"\n\n  documentation:\n    required:\n      - \"Test plan with pass\u002Ffail criteria\"\n      - \"Test execution results with screenshots\"\n      - \"Performance measurements before and after\"\n      - \"Sign-off by operations, engineering, and security\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Compensating Control | Alternative security measure applied when a patch cannot be deployed, such as firewall rules, IPS signatures, or network isolation |\n| Vendor Compatibility | Confirmation from the OT vendor that a patch (especially OS patches) is compatible with their control system software |\n| Maintenance Window | Scheduled period for system modifications, aligned with process shutdowns or reduced-risk operational periods |\n| Virtual Patching | Deploying IDS\u002FIPS rules to detect and block exploitation attempts for known vulnerabilities without modifying the target system |\n| Evaluation Deadline | NERC CIP-007-6 requires patch evaluation within 35 calendar days of availability |\n| Turnaround | Major scheduled shutdown of a process unit for maintenance, providing opportunity for extensive OT patching |\n\n## Tools & Systems\n\n- **WSUS\u002FSCCM**: Microsoft patch management for Windows-based OT systems (HMIs, historians, engineering workstations)\n- **Siemens ProductCERT**: Siemens security advisory service for industrial products\n- **Claroty xDome**: OT vulnerability management with patch availability tracking and risk scoring\n- **Tripwire Enterprise**: Configuration monitoring detecting unauthorized changes and tracking patch status\n\n## Output Format\n\n```\nOT Patch Management Report\n============================\nReporting Period: YYYY-MM to YYYY-MM\n\nPATCH STATUS:\n  Identified: [N]\n  Evaluating: [N]\n  Testing: [N]\n  Deployed: [N]\n  Deferred: [N]\n\nCOMPLIANCE:\n  Evaluated within 35 days: [N]\u002F[N] (CIP-007-6 R2)\n  Deployed or mitigated: [N]\u002F[N]\n  Deferred with compensating controls: [N]\n```\n","# Implementing Patch Management for OT Systems\n\n## When to Use\n\n- When establishing a formal OT patch management program for the first time\n- When responding to critical ICS-CERT advisories affecting deployed OT systems\n- When preparing for NERC CIP-007-6 or IEC 62443 patch management compliance audits\n- When planning patch deployment during limited maintenance windows in continuous operations\n- When evaluating compensating controls for systems that cannot be patched\n\n**Do not use** for IT-only patch management without OT considerations, for emergency patching during active cyber incidents (see performing-ot-incident-response), or for firmware upgrades that change PLC functionality (requires separate change management).\n\n## Prerequisites\n\n- OT asset inventory with firmware\u002FOS versions for all patchable systems\n- Vendor patch notification subscriptions (Siemens ProductCERT, Rockwell, Schneider, etc.)\n- Test\u002Fstaging environment mirroring production OT systems for patch validation\n- Maintenance window schedule aligned with process shutdowns and turnarounds\n- Change management board approval process including operations and safety representatives\n\n## Workflow\n\n### Step 1: Establish OT Patch Management Program\n\nDefine the patch management lifecycle adapted for OT environments where availability and safety take priority over immediate vulnerability remediation.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"OT Patch Management Program Manager.\n\nTracks patches for OT systems, manages risk-based prioritization,\ncoordinates testing and deployment, and documents compensating\ncontrols for unpatchable systems.\n\"\"\"\n\nimport json\nimport sys\nfrom collections import defaultdict\nfrom dataclasses import dataclass, field, asdict\nfrom datetime import datetime, timedelta\nfrom enum import Enum\n\n\nclass PatchStatus(str, Enum):\n    IDENTIFIED = \"identified\"\n    EVALUATING = \"evaluating\"\n    TESTING = \"testing\"\n    APPROVED = \"approved\"\n    SCHEDULED = \"scheduled\"\n    DEPLOYED = \"deployed\"\n    DEFERRED = \"deferred\"\n    NOT_APPLICABLE = \"not_applicable\"\n\n\n@dataclass\nclass OTPatch:\n    patch_id: str\n    vendor: str\n    product: str\n    affected_versions: str\n    cve_ids: list\n    cvss_score: float\n    ics_cert_advisory: str\n    description: str\n    status: str = PatchStatus.IDENTIFIED\n    identified_date: str = \"\"\n    evaluation_deadline: str = \"\"  # 35 days per CIP-007\n    test_date: str = \"\"\n    deployment_date: str = \"\"\n    affected_assets: list = field(default_factory=list)\n    test_results: str = \"\"\n    compensating_controls: str = \"\"\n    risk_rating: str = \"\"\n    maintenance_window: str = \"\"\n    rollback_procedure: str = \"\"\n\n\nclass OTPatchManager:\n    \"\"\"Manages the OT patch lifecycle.\"\"\"\n\n    def __init__(self):\n        self.patches = []\n        self.assets = {}\n        self.vendor_feeds = {}\n\n    def add_patch(self, patch: OTPatch):\n        \"\"\"Register a new patch for tracking.\"\"\"\n        # Set evaluation deadline (35 calendar days per NERC CIP-007)\n        if not patch.evaluation_deadline:\n            identified = datetime.fromisoformat(patch.identified_date)\n            patch.evaluation_deadline = (identified + timedelta(days=35)).isoformat()\n\n        self.patches.append(patch)\n\n    def prioritize_patches(self):\n        \"\"\"Risk-based prioritization for OT patches.\"\"\"\n        for patch in self.patches:\n            if patch.status in (PatchStatus.DEPLOYED, PatchStatus.NOT_APPLICABLE):\n                continue\n\n            # OT-specific risk scoring\n            score = patch.cvss_score\n\n            # Increase priority for actively exploited vulnerabilities\n            if \"CISA KEV\" in patch.ics_cert_advisory:\n                score += 2.0\n\n            # Increase priority for network-exposed OT systems\n            for asset_id in patch.affected_assets:\n                asset = self.assets.get(asset_id, {})\n                if asset.get(\"network_exposed\"):\n                    score += 1.0\n                if asset.get(\"purdue_level\") in (\"Level 0-1\", \"Level 2\"):\n                    score += 1.5\n\n            score = min(score, 10.0)\n\n            if score >= 9.0:\n                patch.risk_rating = \"critical\"\n            elif score >= 7.0:\n                patch.risk_rating = \"high\"\n            elif score >= 4.0:\n                patch.risk_rating = \"medium\"\n            else:\n                patch.risk_rating = \"low\"\n\n    def get_patches_needing_evaluation(self):\n        \"\"\"Get patches approaching evaluation deadline.\"\"\"\n        now = datetime.now()\n        approaching = []\n        for patch in self.patches:\n            if patch.status == PatchStatus.IDENTIFIED:\n                deadline = datetime.fromisoformat(patch.evaluation_deadline)\n                days_remaining = (deadline - now).days\n                if days_remaining \u003C= 7:\n                    approaching.append((patch, days_remaining))\n        return sorted(approaching, key=lambda x: x[1])\n\n    def defer_patch(self, patch_id, reason, compensating_controls):\n        \"\"\"Defer a patch with documented compensating controls.\"\"\"\n        for patch in self.patches:\n            if patch.patch_id == patch_id:\n                patch.status = PatchStatus.DEFERRED\n                patch.compensating_controls = compensating_controls\n                patch.test_results = f\"Deferred: {reason}\"\n                break\n\n    def generate_report(self):\n        \"\"\"Generate patch management status report.\"\"\"\n        self.prioritize_patches()\n\n        report = []\n        report.append(\"=\" * 70)\n        report.append(\"OT PATCH MANAGEMENT STATUS REPORT\")\n        report.append(f\"Date: {datetime.now().isoformat()}\")\n        report.append(\"=\" * 70)\n\n        # Status summary\n        status_counts = defaultdict(int)\n        for p in self.patches:\n            status_counts[p.status] += 1\n\n        report.append(\"\\nPATCH STATUS SUMMARY:\")\n        for status, count in status_counts.items():\n            report.append(f\"  {status}: {count}\")\n\n        # Approaching deadlines\n        approaching = self.get_patches_needing_evaluation()\n        if approaching:\n            report.append(\"\\nAPPROACHING EVALUATION DEADLINES:\")\n            for patch, days in approaching:\n                report.append(f\"  [{patch.patch_id}] {patch.description} - {days} days remaining\")\n\n        # Critical\u002FHigh priority patches\n        urgent = [p for p in self.patches\n                  if p.risk_rating in (\"critical\", \"high\")\n                  and p.status not in (PatchStatus.DEPLOYED, PatchStatus.NOT_APPLICABLE)]\n        if urgent:\n            report.append(f\"\\nURGENT PATCHES ({len(urgent)}):\")\n            for p in urgent:\n                report.append(f\"  [{p.patch_id}] [{p.risk_rating.upper()}] {p.description}\")\n                report.append(f\"    CVEs: {', '.join(p.cve_ids)}\")\n                report.append(f\"    Status: {p.status}\")\n                report.append(f\"    Affected Assets: {len(p.affected_assets)}\")\n\n        # Deferred patches with compensating controls\n        deferred = [p for p in self.patches if p.status == PatchStatus.DEFERRED]\n        if deferred:\n            report.append(f\"\\nDEFERRED PATCHES ({len(deferred)}):\")\n            for p in deferred:\n                report.append(f\"  [{p.patch_id}] {p.description}\")\n                report.append(f\"    Reason: {p.test_results}\")\n                report.append(f\"    Compensating Controls: {p.compensating_controls}\")\n\n        return \"\\n\".join(report)\n\n\nif __name__ == \"__main__\":\n    manager = OTPatchManager()\n\n    # Example patches\n    manager.add_patch(OTPatch(\n        patch_id=\"OT-PATCH-001\",\n        vendor=\"Siemens\",\n        product=\"SIMATIC S7-1500\",\n        affected_versions=\"\u003C V3.0.1\",\n        cve_ids=[\"CVE-2023-44374\"],\n        cvss_score=8.8,\n        ics_cert_advisory=\"ICSA-23-348-01\",\n        description=\"S7-1500 memory corruption via crafted packets\",\n        identified_date=\"2026-01-15\",\n        affected_assets=[\"PLC-01\", \"PLC-02\", \"PLC-03\"],\n    ))\n\n    manager.add_patch(OTPatch(\n        patch_id=\"OT-PATCH-002\",\n        vendor=\"Rockwell Automation\",\n        product=\"FactoryTalk View SE\",\n        affected_versions=\"\u003C V13.0\",\n        cve_ids=[\"CVE-2024-21914\"],\n        cvss_score=7.5,\n        ics_cert_advisory=\"ICSA-24-046-02\",\n        description=\"FactoryTalk View remote code execution\",\n        identified_date=\"2026-02-01\",\n        affected_assets=[\"HMI-01\", \"HMI-02\"],\n    ))\n\n    print(manager.generate_report())\n```\n\n### Step 2: Test Patches in Staging Environment\n\nNever deploy patches directly to production OT systems. Use a test environment that mirrors production to validate patch compatibility.\n\n```yaml\n# OT Patch Testing Procedure\npatch_testing:\n  environment:\n    description: \"Staging lab mirroring production OT architecture\"\n    components:\n      - \"Virtual PLC simulators matching production firmware\"\n      - \"Test HMI stations with identical software versions\"\n      - \"Test historian with representative data\"\n      - \"Network configuration matching production VLANs\u002Ffirewalls\"\n\n  test_cases:\n    functional:\n      - \"PLC programs execute correctly after OS patch\"\n      - \"HMI displays update with correct process values\"\n      - \"Historian data collection continues uninterrupted\"\n      - \"Alarm and event handling functions properly\"\n      - \"Communication between PLCs maintains cycle time\"\n      - \"Safety system trip tests pass (if SIS affected)\"\n\n    performance:\n      - \"PLC scan time remains within acceptable limits (\u003C50ms increase)\"\n      - \"HMI screen refresh rate unchanged\"\n      - \"Historian collection interval maintained\"\n      - \"Network latency between zones unchanged\"\n\n    compatibility:\n      - \"Third-party applications function correctly\"\n      - \"OPC UA\u002FDA connections establish successfully\"\n      - \"Custom scripts and batch processes execute\"\n      - \"Backup and restore procedures work\"\n\n    rollback:\n      - \"System can be reverted to pre-patch state\"\n      - \"Rollback procedure documented and tested\"\n      - \"Estimated rollback time: [N] minutes\"\n\n  documentation:\n    required:\n      - \"Test plan with pass\u002Ffail criteria\"\n      - \"Test execution results with screenshots\"\n      - \"Performance measurements before and after\"\n      - \"Sign-off by operations, engineering, and security\"\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Compensating Control | Alternative security measure applied when a patch cannot be deployed, such as firewall rules, IPS signatures, or network isolation |\n| Vendor Compatibility | Confirmation from the OT vendor that a patch (especially OS patches) is compatible with their control system software |\n| Maintenance Window | Scheduled period for system modifications, aligned with process shutdowns or reduced-risk operational periods |\n| Virtual Patching | Deploying IDS\u002FIPS rules to detect and block exploitation attempts for known vulnerabilities without modifying the target system |\n| Evaluation Deadline | NERC CIP-007-6 requires patch evaluation within 35 calendar days of availability |\n| Turnaround | Major scheduled shutdown of a process unit for maintenance, providing opportunity for extensive OT patching |\n\n## Tools & Systems\n\n- **WSUS\u002FSCCM**: Microsoft patch management for Windows-based OT systems (HMIs, historians, engineering workstations)\n- **Siemens ProductCERT**: Siemens security advisory service for industrial products\n- **Claroty xDome**: OT vulnerability management with patch availability tracking and risk scoring\n- **Tripwire Enterprise**: Configuration monitoring detecting unauthorized changes and tracking patch status\n\n## Output Format\n\n```\nOT Patch Management Report\n============================\nReporting Period: YYYY-MM to YYYY-MM\n\nPATCH STATUS:\n  Identified: [N]\n  Evaluating: [N]\n  Testing: [N]\n  Deployed: [N]\n  Deferred: [N]\n\nCOMPLIANCE:\n  Evaluated within 35 days: [N]\u002F[N] (CIP-007-6 R2)\n  Deployed or mitigated: [N]\u002F[N]\n  Deferred with compensating controls: [N]\n```\n",{"cve":49,"name":5,"tags":52,"capec":57,"model":58,"tools":59,"domain":43,"maxTurns":63,"nist_csf":64,"subdomain":69,"description":7,"mitre_attack":70},[50,51],"CVE-2023-44374","CVE-2024-21914",[53,29,54,55,56,36,35],"ot-security","scada","industrial-control","iec62443",[],"sonnet",[60,31,61,62],"Read","Glob","Grep",20,[65,66,67,68],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security",[71],"T0855","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Findustrial\u002Fics\u002Fvulnerability\u002Fpatch\u002Fmanage\u002Fharden","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":80,"prompt":90,"zipAvailable":91},[81,84,87],{"tool":82,"command":83},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill ics-vulnerability-patch-manage-harden",{"tool":85,"command":86},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill ics-vulnerability-patch-manage-harden",{"tool":88,"command":89},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill ics-vulnerability-patch-manage-harden","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fvulnerability\u002Fpatch\u002Fmanage\u002Fharden\u002FSKILL.md",true,[93],{"path":94,"resourceType":95,"resourceTypeDesc":96,"sizeBytes":97,"sourceHtmlUrl":98},"index.json","REFERENCE","参考文档",732,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Findustrial\u002Fics\u002Fvulnerability\u002Fpatch\u002Fmanage\u002Fharden\u002Findex.json",[100,124,146,167,189,205],{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[107,108,109,110,111,112,33,113,114,115,116,117,118,119,120,121,122,43,123],"services","detect","services wmi persistence detect","wmi","persistence","de","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":125,"name":126,"nameZh":6,"description":127,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":128,"categories":129,"keywords":130,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[131,107,132,110,133,134,135,43,31,136,137,138,139,140,112,141,142,143,144,145],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":152,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[153,154,155,156,157,158,43,31,159,136,160,161,112,143,162,163,164,165,166,58],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[108,174,175,176,177,178,179,33,180,43,123,181,182,183,184,185,186,187,188,112],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":195,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[196,197,108,198,176,178,199,33,200,180,43,123,136,201,202,203,204,188,112,113],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":211,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[212,108,176,213,199,33,214,215,43,123,216,217,218,219,220,221,112,113,222,223],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]