“Living off the land” attacks make use of legitimate, pre-existing code in combination with stolen credentials, rather than by adding malicious code infiltrate and launch attacks including on industrial control (ICS) systems. Lacking the usual indicators of compromise (IoC), detecting attacks requires engineering knowledge of the system, which may not be within possession of SOC analysts or their tool sets. To counter this deficit, we propose using a formal model of the cyber-physical system, coded as a “digital shadow”, to reference the behavior of the underlying system. A divergence in the probability of messaging behavior between the shadowed systems highlights where an intrusion may have occurred. We model this approach using identically defined systems and then illustrate via a simulated attack. As a secondary contribution, we demonstrate that stateful applied pi calculus, with minimal and commonly used process algebraic extensions, is sufficient to model cyber-physical (hybrid) systems without the need to introduce “alien” syntax and semantics, allowing for more straightforward verification.