This article addresses the pressing issue of ensuring the information security of critical information infrastructure (CII) amidst the qualitative evolution of cyber threats and the massive shift of threat actors toward stealthy "Living-off-the-Land" (LotL) attacks. Because such attacks are executed using legitimate administration tools, classical indicators of compromise (IOCs) lose their effectiveness, and traditional monitoring systems generate an excessive number of false alarms, thereby provoking "alert fatigue". To solve this problem, the paper proposes a methodology for the contextual validation of indicators of behavior (IOB) in Industrial Control Systems (ICS) networks. The primary scientific result is the developed "reverse enrichment" algorithm, which utilizes the deterministic nature of the technological process as a strict a priori filter. The algorithm verifies every control action by predicting the next state of the system using a state-space mathematical model and checking its membership in a formalized set of safe values, $\Omega_{safe}$. Additionally, the organizational context, $S_{org}$, including shift schedules and maintenance windows, is taken into account. Unlike probabilistic machine learning approaches, this method provides a strict binary criterion for command admissibility. The effectiveness of the proposed approach is confirmed by simulation results based on the verified dataset of the SWaT (Secure Water Treatment) academic testbed. The implementation of physical and organizational filters achieved a 97.7% False Positive Reduction Rate (FPRR) and successfully detected 1,021 out of 1,035 injected stealthy destructive impacts. The average computational latency of the algorithm was 1.4 ms, which fully satisfies the stringent requirements of real-time systems. The proposed method does not require the instrumentation of legacy field equipment and ensures the precise attribution of cyber incidents based on the physical laws of the production cycle.
