ICtoolS: Fingerprinting ICS Tools to Characterize Honeypot Interactions

Honeypots are widely used to collect Cyber Threat Intelligence (CTI), particularly in Industrial Control System (ICS) environments where understanding malicious activity is critical. Existing analysis strategies, however, may misclassify honeypot interactions, leading to misdirected analytical efforts and misleading conclusions. In this paper, we present ICtoolS, a framework for identifying ICS-capable tool fingerprints within honeypot network traffic logs, which is released as an open-source project. ICtoolS supports multiple log formats and currently implements matchers for the Modbus/TCP and EtherNet/IP protocols through Zeek and PCAP logs, respectively. Using heterogeneous honeypot datasets, we show that ICtoolS reliably distinguishes tools with overlapping functionality and provides valuable context for interactions that traditional function- or actor-based analyses cannot fully explain. By complementing existing approaches, it enables more targeted CTI extraction and reduces noise from irrelevant interactions.