Arya - OT/ICS Security Reconnaissance Tool

Source: github.com/claroty/arya Author: Johan Beysen

1. Overview

Arya is a reconnaissance and security assessment tool developed by Claroty, specifically designed for Operational Technology (OT) and Industrial Control Systems (ICS) networks. The tool helps identify, scan and analyze industrial devices and protocols.

Developer: Claroty Research Type: OT/ICS Security Scanner License: Open Source Repository: https://github.com/claroty/arya

2. Purpose and Applications

2.1 Primary Goals

Asset Discovery: Identifying ICS/SCADA devices on networks
Protocol Analysis: Analyzing industrial communication protocols
Vulnerability Assessment: Detecting security weaknesses in OT devices
Network Mapping: Mapping out industrial network topology
Configuration Auditing: Checking device configurations and security settings

2.2 Use Cases

Penetration Testing: Security assessments of industrial environments
Asset Inventory: A complete inventory of OT devices
Compliance Audits: Verifying security baselines (IEC 62443, NIST)
Incident Response: Quickly identifying devices during security incidents
Network Segmentation: Verifying OT/IT network separation

3. Supported Protocols and Technologies

3.1 Industrial Protocols

Protocol	Description	Default Port(s)
Modbus TCP	PLC communication protocol	502
Modbus RTU	Serial variant of Modbus	Serial/RTU
S7/S7comm	Siemens PLC protocol	102
EtherNet/IP	Rockwell Automation protocol	44818, 2222
BACnet	Building automation protocol	47808 (UDP)
DNP3	SCADA/utility protocol	20000
OPC UA	Industrial communication standard	4840
PROFINET	Siemens industrial ethernet	-

3.2 Device Types

PLCs (Programmable Logic Controllers)
HMIs (Human Machine Interfaces)
RTUs (Remote Terminal Units)
SCADA Masters
Industrial Switches/Routers
Building Management Systems
Industrial IoT Devices

4. Installation

4.1 Prerequisites

# Kali Linux / Debian
sudo apt update
sudo apt install python3 python3-venv git

# Clone the repository
git clone https://github.com/claroty/arya
cd arya

4.2 Virtual Environment Setup

# Create a virtual environment
python3 -m venv venv

# Activate the virtual environment
source venv/bin/activate

# Install dependencies
pip3 install -r requirements.txt

# Verify the installation
python3 arya.py --help

4.3 Quick Alias Setup

Add to ~/.bashrc or ~/.zshrc:

alias arya='cd ~/arya && source venv/bin/activate'

5. Basic Commands

5.1 General Syntax

python3 arya.py [OPTIONS] -t TARGET

5.2 Essential Options

Option	Description
`-t, --target`	Target IP address or CIDR range
`-p, --protocols`	Specific protocols to scan (comma-separated)
`-o, --output`	Output file (JSON/CSV/XML)
`-v, --verbose`	Verbose output
`--timeout`	Connection timeout (default: 5s)
`--threads`	Number of concurrent threads

6. Practical Examples

6.1 Basic Network Scan

# Scan a single IP address
python3 arya.py -t 192.168.1.100

# Scan an entire subnet
python3 arya.py -t 192.168.1.0/24

# Scan with verbose output
python3 arya.py -t 192.168.1.0/24 -v

6.2 Protocol-Specific Scans

# Scan Modbus devices only
python3 arya.py -t 192.168.1.0/24 -p modbus

# Scan Modbus and S7
python3 arya.py -t 192.168.1.0/24 -p modbus,s7

# Scan all supported protocols
python3 arya.py -t 192.168.1.0/24 -p all

6.3 Advanced Scans

# Scan with an output file
python3 arya.py -t 192.168.1.0/24 -o results.json

# Scan with a custom timeout and thread count
python3 arya.py -t 192.168.1.0/24 --timeout 10 --threads 20

# Extended scan with vulnerability checks
python3 arya.py -t 192.168.1.0/24 --vulns -v -o full_report.json

6.4 Targeted Device Scans

# Scan a specific Siemens PLC
python3 arya.py -t 192.168.1.50 -p s7 --device-info

# Scan Modbus slave devices
python3 arya.py -t 192.168.1.100 -p modbus --read-coils --read-registers

# BACnet device enumeration
python3 arya.py -t 192.168.1.0/24 -p bacnet --enumerate

7. Output Formats

7.1 JSON Output

python3 arya.py -t 192.168.1.0/24 -o scan_results.json

Example JSON structure:

{
  "scan_time": "2025-12-01T14:30:00",
  "target": "192.168.1.0/24",
  "devices": [
    {
      "ip": "192.168.1.100",
      "protocol": "modbus",
      "device_type": "PLC",
      "vendor": "Schneider Electric",
      "model": "M340",
      "firmware": "2.80",
      "vulnerabilities": []
    }
  ]
}

7.2 CSV Output

python3 arya.py -t 192.168.1.0/24 -o scan_results.csv --format csv

8. Security Considerations

Critical Warnings

Authorization Required
Use ONLY with explicit permission
OT/ICS scans can disrupt production
Unauthorized scans are illegal (Computer Crime Act)
Production Environments
Test in a LAB environment first
Some queries can crash devices
Schedule scans during maintenance windows
Inform the operations team beforehand
Rate Limiting
Use low thread counts in production
Increase timeouts for stable devices
Monitor device responses during scans

Best Practices

# Safe scan configuration for production
python3 arya.py -t 192.168.1.0/24 \
  --threads 5 \
  --timeout 10 \
  --rate-limit 2 \
  -v

# Lab/test environment (more aggressive)
python3 arya.py -t 192.168.1.0/24 \
  --threads 50 \
  --timeout 3 \
  --vulns

9. Integration with Security Tools

9.1 Combining with Nmap

# First, Nmap for port discovery
nmap -sS -p 102,502,47808,44818 192.168.1.0/24 -oG nmap_ics.txt

# Then, Arya for protocol analysis
python3 arya.py -t 192.168.1.0/24 -p modbus,s7

9.2 Metasploit Integration

# Export Arya results
python3 arya.py -t 192.168.1.0/24 -o targets.json

# Import into Metasploit
msfconsole
msf6 > use auxiliary/scanner/scada/modbusdetect
msf6 > set RHOSTS file:targets.txt

9.3 SIEM Integration

# Export for log analysis
python3 arya.py -t 192.168.1.0/24 -o /var/log/arya/scan_$(date +%Y%m%d).json

# Scheduled scanning
0 2 * * * cd ~/arya && source venv/bin/activate && python3 arya.py -t 10.0.0.0/16 -o /var/log/arya/daily_scan.json

10. Use Cases per Scenario

10.1 Scenario 1: Initial Asset Discovery

Goal: A complete inventory of an unknown OT network

# Step 1: Broad network scan
python3 arya.py -t 10.100.0.0/16 -o initial_discovery.json

# Step 2: Analyze results
cat initial_discovery.json | jq '.devices[] | .ip, .protocol, .vendor'

# Step 3: Deep scan per protocol
python3 arya.py -t 10.100.10.0/24 -p modbus --device-info -o modbus_details.json
python3 arya.py -t 10.100.20.0/24 -p s7 --device-info -o s7_details.json

10.2 Scenario 2: Security Audit

Goal: Vulnerability assessment and a compliance check

# Comprehensive security scan
python3 arya.py -t 192.168.1.0/24 \
  --vulns \
  --check-defaults \
  --enumerate-all \
  -o security_audit.json \
  -v

# Check for default credentials
python3 arya.py -t 192.168.1.0/24 --default-creds -o weak_auth.json

# Firmware version check
python3 arya.py -t 192.168.1.0/24 --firmware-check -o outdated_fw.json

10.3 Scenario 3: Incident Response

Goal: Quickly identifying compromised devices

# Quick scan of a critical subnet
python3 arya.py -t 10.10.10.0/24 \
  --threads 100 \
  --timeout 2 \
  -o incident_scan.json

# Compare against a baseline
diff baseline.json incident_scan.json > changes.txt

10.4 Scenario 4: Penetration Test

Goal: Security assessment of an OT environment

# Phase 1: Reconnaissance
python3 arya.py -t 172.16.0.0/12 -o recon.json

# Phase 2: Service enumeration
python3 arya.py -t 172.16.10.0/24 -p all --enumerate -o services.json

# Phase 3: Vulnerability scanning
python3 arya.py -t 172.16.10.0/24 --vulns --exploit-check -o vulns.json

# Phase 4: Targeted exploitation (with Metasploit)
# Use discovered info for the exploitation phase

11. Troubleshooting

11.1 Common Issues

Issue 1: Connection Timeouts

# Increase the timeout
python3 arya.py -t 192.168.1.100 --timeout 30

# Reduce threads
python3 arya.py -t 192.168.1.0/24 --threads 5

Issue 2: No Devices Found

# Check network connectivity
ping 192.168.1.100

# Verify the ports are open
nmap -p 502 192.168.1.100

# Try a specific protocol
python3 arya.py -t 192.168.1.100 -p modbus -v

Issue 3: Permission Denied

# Some protocols require root
sudo python3 arya.py -t 192.168.1.0/24

# Or use capabilities
sudo setcap cap_net_raw+ep $(which python3)

Issue 4: Import Errors

# Reactivate the virtual environment
source venv/bin/activate

# Reinstall dependencies
pip3 install -r requirements.txt --force-reinstall

12. Lab Setup Examples

12.1 Proxmox Lab for OT Testing

VM Setup: 1. Kali Linux (attacker) 2. OpenPLC (Modbus PLC simulator) 3. ScadaBR (SCADA system) 4. Node-RED (ICS gateway)

Network Configuration:

VLAN 10: IT Network (192.168.10.0/24)
VLAN 20: OT Network (192.168.20.0/24)
Firewall: FortiGate between the VLANs

Test Scenario:

# From Kali in the IT VLAN, scan the OT VLAN
python3 arya.py -t 192.168.20.0/24 -o ot_discovery.json

# Verify firewall blocks/allows
# Test FortiAnalyzer logging
# Check FortiNAC device profiling

13. Reporting

13.1 Generating an Executive Summary

# Scan and generate a report
python3 arya.py -t 192.168.1.0/24 -o full_scan.json

# Parse for a management report
cat full_scan.json | jq '
{
  "total_devices": (.devices | length),
  "by_vendor": (.devices | group_by(.vendor) | map({vendor: .[0].vendor, count: length})),
  "vulnerabilities": (.devices | map(.vulnerabilities) | flatten | length),
  "critical_devices": (.devices | map(select(.vulnerabilities | length > 0)))
}' > executive_summary.json

13.2 Visual Reports

Use tools such as: - Grafana: A dashboard for continuous monitoring - ELK Stack: For log aggregation and visualization - Splunk: Enterprise SIEM integration

14. Cheat Sheet

14.1 Quick Reference

# Basic scan
python3 arya.py -t 192.168.1.0/24

# All protocols
python3 arya.py -t 192.168.1.0/24 -p all

# With vulns
python3 arya.py -t 192.168.1.0/24 --vulns

# Verbose + output
python3 arya.py -t 192.168.1.0/24 -v -o results.json

# Fast scan
python3 arya.py -t 192.168.1.0/24 --threads 100 --timeout 2

# Safe production scan
python3 arya.py -t 192.168.1.0/24 --threads 5 --timeout 10 --rate-limit 2

15. Legal & Compliance

15.1 Legislation (Belgium/EU)

Computer Crime Act: Unauthorized access is a criminal offense
GDPR: Be mindful when logs contain personal data
IEC 62443: Security standards for industrial control systems
NIS2 Directive: Critical infrastructure security requirements

15.2 Documentation Requirements

For pentests, document: - Scope agreement - Authorization letters - Rules of engagement - Incident response contacts - Backup/rollback procedures

16. Resources

16.1 Official Documentation

GitHub: https://github.com/claroty/arya
Claroty Research: https://claroty.com/team82

ICS-PCAP: Protocol analysis
PLCscan: PLC enumeration
ISF: Industrial exploitation framework
SCADAshutdowntool: Emergency response

16.3 Learning Resources

SANS ICS/SCADA Security (ICS515)
CISA ICS Security Resources
ICS-CERT Advisories

17. Changelog & Updates

Check regularly for updates:

cd ~/arya
git pull origin main
pip3 install -r requirements.txt --upgrade

Important Points to Remember

Always test in a LAB environment first
Use ONLY with permission
Document all activities
Back up critical systems before scanning
Inform operations teams

For questions or issues: Check the GitHub issues or Claroty documentation