This paper aims to study the workflow of the detection centre of stealthy attacks on industrial installations that generate an increase in energy consumption. Such long-lasting, undetected attacks on industrial facilities make production more expensive and less competitive or damage the installation in the long term. We present the concept of the remote detection system of cyberattacks directed at maliciously changing the controlled variable in an industrial process air conditioning system. The monitored signals are gathered at the PLC-controlled installation and sent to the remote detection system, where the discrepancies of signals are analysed based on the Control Performance Assessment indices. The results of performed tests prove the legitimacy of the adopted approach.