ShadowICS: Detecting OT Sandboxes via Passive Industrial Traffic Monitoring

Industrial Control Systems (ICSs) are increasingly targeted by sophisticated OT malware, yet the dynamic analysis tools used to study such threats rely on virtualized environments whose realism remains largely unverified. Advanced IT malware routinely detects sandbox artifacts to evade analysis, but whether analogous evasion strategies are feasible in OT settings, where industrial traffic and physical-process dynamics offer distinctive fingerprints, has never been studied. In this paper, we first survey 12 real-world OT malware samples and confirm that no existing OT malware employs anti-analysis checks, despite the clear opportunity to exploit OT-specific signals as sandbox fingerprints. Building on this finding, we introduce ShadowICS, a passive measurement framework that characterizes an OT-specific anti-analysis capability, trained on a novel taxonomy of OT features spanning temporal, physical-process, and network dimensions. Using lightweight machine learning models, ShadowICS quantifies how distinguishable real OT deployments are from simulations across multiple in-network vantage points, reaching up to 97.9% accuracy and revealing how often current sandboxes betray themselves under purely passive observation. Finally, we translate our findings into concrete mitigation strategies for sandbox designers, identifying temporal realism as the primary target for improvement.