S7comm Reconnaissance: Repeated COTP Connection Requests to Port 102

Emiliano Mema@Nosalva

•updated Aug 28, 2026•1•0•2

Detects repeated attempts to establish S7comm connections to a Programmable Logic Controller (PLC) on port 102. This behavior is indicative of network reconnaissance or scanning targeting Industrial Control Systems (ICS).