Supermarket freezers hacked overnight in Belgium and Sweden
https://sockanalyst.com/patch-now/supermarket-freezer-hacks-belgium-sweden

Splunk
index=firewall action=allowed direction=inbound dest_port IN (80,443,502,1911,4911,8080,47808)
dest_category="ot_refrigeration"
| stats count min(_time) as first max(_time) as last by src_ip, dest_ip, dest_port
| sort - count

Sentinel
CommonSecurityLog
| where DeviceAction in~ ("allow","accept") and DestinationPort in (80,443,502,1911,4911,8080,47808)
| where DestinationIP in (_GetWatchlist('RefrigerationControllers') | project SearchKey)
| summarize count(), min(TimeGenerated), max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort