OpcUaTrap

A high-interaction OPC UA honeypot for ICS/SCADA environments. Built on LibUA — a full OPC UA Binary stack, not a protocol emulator. Simulates realistic industrial control systems across multiple industry profiles with live process values, comprehensive threat detection, and SIEM-ready logging.

Built by 0xAJStrike.

📄 Talk: Read the Plant like a Blueprint — the SecTor 2026 presentation this tool was built for (OPC UA attack surface, honeypot design, and a live demo).

Why High Interaction?

Most ICS honeypots (Conpot, GRFICSv2) offer partial protocol emulation. OpcUaTrap implements the full OPC UA Binary protocol — secure channel negotiation, session lifecycle, subscriptions, history, and all service sets. Real exploit tools and scanners (OpalOPC, Nmap OPC UA scripts) interact with it as they would a production system.

	Low	Medium	OpcUaTrap
Protocol	Banner only	Partial emulation	Full real stack
Session state	None	Basic	Full lifecycle
Address space	Static / empty	Handful of nodes	100–130 realistic nodes
Subscriptions	No	No	Yes — live data pushed
Exploit resilience	Crashes	Partial	Survives full frameworks

---

Features

• Three industry profiles — oil & gas, water treatment, power grid — each with 100–130 live process nodes
• Full OPC UA protocol — browse, read, write, call, history read, subscriptions, 4 security endpoints
• Live simulation — 1-second tick, gaussian noise, mean-reverting drift, tank fill/drain dynamics
• 12 threat detection rules — per-session scoring (0–100), honeytoken detection, enumeration detection, bulk exfil, credential spraying, and more
• Anti-fingerprinting — fake vendor identity, response timing jitter, realistic error codes, uptime randomization
• Pluggable SIEM logging — NDJSON (always on), syslog RFC 5424, ArcSight CEF, HTTP webhooks, Elasticsearch direct ingest
• Profile-driven hardening — authentication policy, account lockout, service restrictions — all configurable per JSON profile

---

Quick Start

Run with Docker (fastest)

docker run -d --name opcuatrap -p 4840:4840 \
  -e OPCUATRAP_PROFILE=oil-gas \
  -v opcuatrap-data:/data \
  ghcr.io/0xajstrike/opcuatrap:latest

The honeypot is now live on opc.tcp://<host>:4840. Switch the facility with -e OPCUATRAP_PROFILE=water-treatment (or power-grid). The image is multi-arch (amd64 + arm64, so it runs on a Raspberry Pi too), non-root, and persists its certificate and NDJSON logs to the opcuatrap-data volume. Full Docker details (Compose, all env vars) are under Deployment → Docker.

Prerequisites

• .NET 9.0 SDK or newer — required to build from source, because the bundled LibUA multi-targets up to net9.0. The honeypot itself runs on the .NET 8 runtime. (Not needed if you use Docker — the image builds everything internally.)

• LibUA — the OPC UA stack. OpcUaTrap builds against a lightly modified fork (0xAJStrike/LibUA, a fork of nauful/LibUA) that adds defense-in-depth limits for several OPC UA CVEs plus optional honeypot deception responses.

  Clone both repositories side by side under a common parent directory:

  git clone https://github.com/0xAJStrike/OpcUaTrap.git
  git clone https://github.com/0xAJStrike/LibUA.git
  

  Expected layout (OpcUaTrap references ../../../LibUA/NET-Core/LibUA/LibUA.csproj relative to its project file, i.e. LibUA sits next to OpcUaTrap):

  parent/
  ├── OpcUaTrap/   # this repo
  └── LibUA/       # the fork, cloned as a sibling
  

Build

dotnet build src/OpcUaTrap/OpcUaTrap.csproj

Run

# Oil & gas profile (default, port 4840)
dotnet run --project src/OpcUaTrap

# Water treatment profile
dotnet run --project src/OpcUaTrap -- --profile water-treatment

# Power grid profile
dotnet run --project src/OpcUaTrap -- --profile power-grid

# Custom port
dotnet run --project src/OpcUaTrap -- --port 7718

# Custom log directory
dotnet run --project src/OpcUaTrap -- --log-dir /var/log/opcuatrap

The server starts in ~400ms and begins simulating process values immediately.

---

Industry Profiles

Profiles are JSON files in src/OpcUaTrap/Profiles/. Each defines the facility identity, full address space, tag classification, simulation rules, and hardening config.

Profile	--profile	Facility	Nodes	Vendor Identity
oil-gas	(default)	PetroVista Central Processing Facility	~120	Schneider Electric SCADAPack 57x
water-treatment	water-treatment	Cascade Municipal Water Treatment Plant	~100	Rockwell Automation ControlLogix
power-grid	power-grid	Ridgeline 138kV Transmission Substation	~130	ABB RTU560

Oil & Gas — Address Space

PetroVista Central Processing Facility/
  Site_Information/
  Wellheads/            WH_101 – WH_104  (pressure, temp, flow, choke position)
  Separators/           SEP_HP_201, SEP_LP_202  (pressure, level, setpoints)
  TankFarm/             TK_OIL_301, TK_OIL_302  (level, alarms, inlet/outlet valves)
  PumpStations/         PMP_XFER_401  (speed, discharge pressure, start/stop commands)
  CompressorStation/    COMP_501  (RPM, vibration, discharge temp, load %)
  Pipelines/            PL_EXPORT_601  (pressure, flow, block valve)
  SafetySystems/        ESD  (status, shutdown valves, trigger/reset methods)
                        FireAndGas  (gas detectors %LEL, flame detectors)
  Utilities/            Instrument air, fuel gas, power generation

Water Treatment — Address Space

Cascade Municipal Water Treatment Plant/
  Site_Information/
  RawWaterIntake/       Flow, turbidity, pH, temp, intake pumps, isolation valve
  Coagulation/          Rapid mix, alum dose rate and setpoint
  Flocculation/         Slow mixer, polymer feed rate and setpoint
  Sedimentation/        Basin levels, turbidity, sludge blanket, scrapers
  Filtration/           4 filters — differential pressure, turbidity, backwash status
  Disinfection/         Primary/secondary chlorination, ammonia feed (chloramine)
  ClearWell/            Finished water storage — level, turbidity, pH, Cl2 residual
  Distribution/         High-service pumps, pressure zones, elevated tank level
  SafetySystems/        ESD, chlorine/ammonia leak detectors and isolation valves
  Utilities/            Power, backup generator, SCADA system status

Power Grid — Address Space