S7comm Connection to PLC from Non-Allowlisted Engineering Workstation
Detects network connections using the S7comm protocol (port 102) targeting Programmable Logic Controllers (PLCs) originating from IP addresses not present in the defined allowlist of authorized engineering workstations. This behavior may indicate unauthorized access, reconnaissance, or malicious activity within an Industrial Control System (ICS) environment.
Microsoft Sentinel (KQL)
