S7comm Off-Hours or Machine-Speed Scripted Activity (Port 102)
Detects anomalous S7comm (Siemens S7 Communication) traffic directed to port 102, which is commonly used by PLCs and ICS devices. The rule identifies potential automated, scripted, or unauthorized activity by monitoring for connections occurring outside of standard business hours (6 PM to 8 AM) or exhibiting high-frequency connection patterns (exceeding 1 connection per second), which may indicate scanning, brute-forcing, or interaction with ICS hardware by unauthorized actors.
Microsoft Sentinel (KQL)
