This paper presents some results related to the detection and isolation of cyber attacks in a recently proposed benchmark based on a two-tank system. The benchmark proposes some attack scenarios in which a malicious attacker alters the signals of the water level sensors in the tanks, in order to remain hidden while stealing water. This paper shows the difficulty to detect cyber attacks based only on the model based residuals calculated using the measured variables. On the other hand, by using the time evolution pattern analysis of the measured sensors, it becomes possible to detect some of these cyber attacks.