Generate a Airport SITREP And in minutes identify the size and scope of the adversarial cyber attack
Airport cyber incident investigations often involve records scattered across enterprise networks, airport operations systems, access-control platforms, badge records, baggage systems, flight-information displays, gate systems, vendor maintenance access, camera metadata, facility-control systems, security tools, and operational event records. REMI AI brings those mixed sources together and generates a cyber SITREP that explains the situation in plain English. It identifies what happened, how access was achieved, which systems were touched, whether airport operations or facility-control activity occurred, where suspicious files or AI-spawned tools appeared, what remains unproven, and which records support the sequence.
Instead of manually comparing SIEM alerts, endpoint logs, VPN activity, vendor-access records, engineering workstation events, HMI logs, control-configuration changes, historian records, and portable-media activity one source at a time, REMI analyzes the full evidence set together. REMI is designed to understand advanced AI-enabled disruption patterns, including state-actor style reconnaissance, delayed execution, lateral movement, tool spawning, configuration probing, and activity that may not look dangerous until it is reconstructed across systems and time.
REMI SUPPORTS BOTH TOWER and the Airport's IT Network
REMI analyzes evidence from both enterprise incident response and water treatment OT/IT environments, including endpoint activity, VPN and identity records, firewall logs, SCADA activity, HMI actions, PLC/RTU events, historian data, alarms, vendor access, and maintenance records.
By connecting these records across IT and water operations, REMI helps investigators see whether a cyber incident stayed inside enterprise systems or moved toward treatment, pumping, chemical-feed, distribution, or water-quality processes. It reconstructs what happened, which systems were touched, what changed, what evidence supports the findings, and what records are still needed to close the gaps.
IT Event Logs
OT Event Logs
Operator screens, commands, acknowledgments, setpoint changes, overrides, and control-room activity.
Controller events, logic edits, downloads, forced values, mode changes, and device status records.
Trend values, tag changes, pressure, flow, temperature, voltage, frequency, tank level, and process state records.
Alarm floods, silenced alarms, acknowledgments, resets, threshold changes, and abnormal operating states.
Project file changes, configuration tools, controller uploads/downloads, user activity, scripts, and remote sessions.
VPN sessions, jump hosts, maintenance accounts, vendor diagnostics, source IPs, and access windows.
Firewall flows, switch records, protocol traffic, segmentation events, OT network paths, and unusual connections.
Work orders, change tickets, approved maintenance windows, asset-owner records, and configuration approvals.
REMI Is Trained to Recognize Advanced Adversarial Cyber Behaviors in Nuclear Plant Environments
REMI is trained to recognize advanced adversarial cyber behaviors in both enterprise incident response and water treatment environments.
REMI analyzes industrial vendor logs to identify suspicious access, lateral movement, AI-spawned tools, configuration changes, disruption indicators, and activity that may only become clear when plant, engineering, vendor, security, and control-system records are reviewed together.
OT Behavioral Detection
Chlorine, pH, fluoride, polymer, feed-rate, or dosing changes outside expected patterns.
Abnormal starts, stops, tank levels, pressure shifts, or flow changes.
Logic edits, controller downloads, setpoint changes, forced values, or mode changes.
Unusual commands, overrides, screen access, or alarm acknowledgments.
Missing telemetry, alarm floods, quiet periods, resets, or altered trends.
VPN sessions, jump hosts, diagnostics, maintenance accounts, and source IPs.
Turbidity, residuals, sensor readings, sample records, or threshold violations.
Reservoirs, valves, pressure zones, booster stations, storage tanks, or downstream effects.
IT Behavioral Detection
New locations, impossible travel, off-hours access, failed MFA, token reuse, or abnormal login patterns.
Unexpected processes, scripts, malware paths, dropped files, persistence, hashes, and device telemetry.
Internal traffic, external callbacks, DNS activity, VPN sessions, ports, protocols, and lateral movement paths.
Admin role changes, permission updates, group membership changes, service accounts, and token activity.
Storage access, mailbox activity, API calls, app credentials, file sharing, downloads, and data movement.
Large transfers, unusual downloads, external sharing, archive creation, USB activity, and abnormal outbound traffic.
After-hours access, unusual file access, policy bypasses, removable media use, deleted logs, or access outside job role.
Shared credentials, approved access used at abnormal times, suspicious vendor coordination, unlocked remote tools, or access enabled before activity.
Behaviors & Pattern Categories
VPN sessions, jump hosts, RDP/SSH access, vendor maintenance accounts, new source IPs, and off-hours access into airport networks.
MFA activity, token use, privileged accounts, shared accounts, failed access, role changes, PAM activity, and account behavior outside normal patterns.
Traffic moving between enterprise systems, operations desktops, vendor access paths, airport support networks, and operational platforms.
Process chains, scripts, PowerShell, registry changes, scheduled tasks, services, dropped files, and activity on airport operations workstations.
Generated scripts, staged binaries, beaconing tools, command channels, loaders, rootkits, and malware paths appearing across systems.
Outbound callbacks, DNS tunneling, DoH activity, fast-flux domains, proxy traffic, WAF events, unusual ports, and suspicious external connections.
Compression activity, staged folders, bulk file movement, large exports, temporary archives, and transfer preparation before removal or exfiltration.
Email access, cloud sync, eDiscovery exports, OAuth activity, shared storage access, app credentials, and unusual SaaS activity.
Bulk queries, dumps, high-volume reads, application exports, passenger-service records, operational databases, and airport application logs.
BHS events, FIDS/BIDS updates, carousel changes, gate display records, route/display mismatches, and abnormal operational screen changes.
Boarding systems, kiosks, shared workstations, common-use terminals, check-in systems, passenger-processing tools, and terminal operations records.
Badge activity, door events, secure-zone access, after-hours entry, access denials, camera metadata, and restricted-area movement records.
Tower event notes, system-status records, outage timing, runway/taxiway support events, communications timing, and operational disruption records.
ADS-B, MLAT, ASTERIX-style feeds, GPS/PTP/NTP timing offsets, aircraft position records, altitude/speed data, and sensor-timing mismatches.
BMS, HVAC, power, alarms, life-safety systems, building controls, backup systems, and airport facility events tied to disruption timing.
Work orders, diagnostics, approved windows, remote support sessions, maintenance packages, update files, and vendor account activity.
USB activity, removable-media transfers, device insertions, file copies, endpoint device history, and portable diagnostic package use.
Disabled logging, audit-policy changes, SIEM suppression, EDR exclusions, deleted records, timestamp changes, and reduced telemetry.
Credential dumping, LSASS access, Kerberos activity, service-account use, cached logons, tokens, certificates, vault access, and secret retrieval.
Reconnaissance, delayed execution, staging, tool deployment, repeated probing, backup/snapshot activity, and pre-positioning inside airport networks.
Cyber activity aligned with access-control records, camera metadata, facility alarms, airport operations timing, vendor presence, or restricted-area movement.
Correlation Is Where the Incident Story Starts to Form
REMI connects scattered flagged behaviors into the first clear view of how malware activity connects to operational disruption.
REMI connects related activity across plant, engineering, vendor, security, and control-system records so responders can see how separate events fit together.
A single alert rarely explains a nuclear cyber event. One system may show vendor access, another may show engineering workstation activity, another may show a diagnostic package or file change, and another may show activity near HMI, historian, or control-configuration records. REMI correlates those records by time, account, device, IP address, file, process, session, and repeated behavior to build the first evidence-backed version of the story.
Details: NPE-LT-18 was tied to c.arden, whose VPN login came from 203.0.113.44 one week after the laptop was reported stolen.
Why it matters: The same engineer’s device history and account activity are now linked to the remote-access event.
Details: The c.arden VPN session reached 10.77.18.25 inside the nuclear business network 13 seconds after login.
Why it matters: The remote session did not stop at authentication; it reached an internal network destination.
Details: The same session moved from 10.77.18.25 to OPS-DT-07 43 seconds later.
Why it matters: The activity moved from network entry into a usable internal desktop environment.
Details: OPS-DT-07 connected toward NPE-ENG-04 inside the nuclear engineering support environment 2 minutes 12 seconds later.
Why it matters: The path crossed from business-network access toward engineering support systems.
Details: NPE-ENG-04 activity aligned with historian-support records 2 minutes 38 seconds later.
Why it matters: The engineering workstation path is now connected to plant-support records.
on-the-spot Reporting
Advanced Cyber Attacks On Nuclear Power Facilities
REMI generates both nuclear-specific reports and broader incident response reports from the same evidence package. For nuclear environments, the reports focus on plant, engineering, vendor, security, and control-system activity, including HMI events, historian records, control-configuration changes, vendor maintenance access, portable-media activity, and plant-adjacent IT/OT behavior.
Reporting Package
What happened, what systems were affected, and what needs attention.
Flagged behaviors, triggered indicators, affected sources, and first observed activity.
Suspicious access, unusual process activity, abnormal commands, persistence, tool spawning, and disruption patterns.
Event-by-event sequence showing when activity began, spread, changed, and ended.
Connects accounts, devices, IP addresses, files, processes, sessions, and events across separate sources.
Related users, vendors, machines, tools, accounts, and systems involved in the event.
Touched devices, high-priority systems, and records showing configuration or settings changes.
Files, paths, logs, artifacts, scripts, binaries, hashes, and evidence to preserve.
Size, scope, findings, open questions, and prioritized responder actions.
SitRep
The evidence-backed sequence of events from first activity through affected systems.
Accounts, devices, networks, systems, vendors, files, sessions, and source records.
Entry point, connection path, lateral movement, trusted access paths, and systems touched.
Account use, approvals, shared access, vendor activity, or open remote tools tied to the evidence.
Findings supported by source records, timestamps, logs, artifacts, and system activity.
Open questions where the current evidence does not yet prove the full answer.
Logs, approvals, asset-owner records, vendor records, source files, or telemetry needed to close each gap.
Preserve, isolate, sandbox, remove, remediate, verify, escalate, or request additional records.
Story Gaps
Question: Was the VPN login approved?
Event logs needed: Maintenance ticket, vendor work order, change approval, and MFA approval record.
Question: Was this source location expected?
Event logs needed: VPN source-IP history, identity sign-in logs, geolocation records, and vendor access baseline.
Detail gap: Was this an approved intermediate host?
Event logs needed: Asset inventory, firewall flow logs, DHCP/DNS records, system owner records, and approved remote-access path records.
Question: Which engineering actions were performed?
Event logs needed: EDR telemetry, engineering workstation logs, project-file access records, tool execution logs, and jump-host records.
Question: Who used the VPN account?
Event logs needed: MFA device record, identity provider logs, account-owner record, vendor assignment record, and privileged-access logs.
Actionable items
Preserve logs for vendor_maint_02, source IP 203.0.113.44, internal host 192.165.43.18, desktop OPS-DT-07, and engineering workstation ENG-WS-04 before removal.
Isolate OPS-DT-07 and ENG-WS-04 from the network. Firewall and EDR records show the VPN path moved through these systems.
Search ENG-WS-04 for C:\Users\Public\update-task.vbs, C:\Temp\stage.ps1, and C:\ProgramData\svc-loader.bat.
Search OPS-DT-07 for C:\Users\j.martinez\AppData\Roaming\sysrunner.exe and preserve a forensic copy for sandboxing.
After preservation, remove C:\Temp\stage.ps1, C:\ProgramData\svc-loader.bat, and C:\Users\Public\update-task.vbs from affected hosts.
Disable vendor_maint_02, revoke active VPN sessions, rotate credentials, reset MFA, and review vendor access tied to 203.0.113.44.
Review and remediate project folders on ENG-WS-04, including D:\Engineering\Projects\NorthPump and related control-support files touched during the session.
Check OPS-DT-07, ENG-WS-04, 192.165.43.18, and VPN logs for new callbacks, scheduled tasks, repeated processes, reopened sessions, or restored persistence.
Use Case:
how REMI turns event logs and source records into a cyber SITREP
AI-Spawned Malware Controller Inside Engineering Support
At 5:18 AM, the plant systems engineer at Granite Ridge Nuclear Station noticed that engineering support records did not line up with the overnight work plan. Nothing was fully down, but the pattern was wrong: an engineering workstation showed command activity after the maintenance window, a historian support server recorded...
Download remi_nuclear_ai_malware_controller_sitrep_use_case.pdf
AI-Generated Logic Package Disguised as Vendor Maintenance
At 6:04 AM, the control systems engineer at Granite Ridge Nuclear Station noticed that auxiliary support values did not line up with the approved post-maintenance baseline. The plant support system was stable, but the pattern was wrong: a controller showed a new active revision, the upload time came after the approved vendor window, and the package name matched a work order while the behavior did not match the signed baseline.
Download: remi_nuclear_ai_logic_package_sitrep_use_case.pdf
AI-Directed Pre-Positioning Across Nuclear Support Systems
At 4:37 AM, the cyber security lead at Granite Ridge Nuclear Station noticed that low-volume access across plant support systems did not line up with the overnight work plan. Nothing triggered a major alarm, but the pattern was wrong: a service account touched historian servers, a jump host launched administrative tools, and an engineering file share recorded folder enumeration during a window with no approved support activity.
Download: remi_nuclear_ai_logic_package_sitrep_use_case.pdf