Defenses against BGP hijacks include IP prefix filtering, meaning IP address announcements are sent and accepted only from a small set of well-defined autonomous systems, and monitoring Internet traffic to identify signs of abnormal traffic flows.

UEBA will work better because it's doing behavior analytics on the admins unlike a WAF that protects only web traffic in this case.

One of the known security concerns with the Distributed Network Protocol version 3 (DNP3), which is used in SCADA systems, is the lack of built-in security features, including authentication.
This means that by default, it does not verify the identity of the entities communicating, making it susceptible to unauthorized access and commands.