S7comm Unauthorized GET/Read Requests on PLC Data Blocks

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•2

Detects unauthorized S7comm 'GET' or 'Read' operations directed at Siemens S7 Series PLCs over TCP port 102. These commands are often used in reconnaissance phases of ICS/OT attacks to map memory blocks, read ladder logic, or identify system state before executing more disruptive operations.