S7comm Connection from Non-Allowlisted Engineering Workstation

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•3

This rule detects network connections using the S7comm protocol (typically on TCP port 102) directed at Siemens S7 PLCs from source hosts that are not identified as authorized engineering workstations. This behavior may indicate unauthorized access, reconnaissance, or lateral movement within an Industrial Control System (ICS) environment.