Default Credential Exploitation Against Exposed S7 PLCs

Emiliano Mema@Nosalva

•updated Aug 28, 2026•0•0•1

Detects unauthorized network sessions targeting Siemens S7 PLCs. The rule specifically identifies unauthenticated S7comm protocol traffic on TCP port 102 and the usage of default SNMP community strings ('public' or 'private') on port 161, which are indicative of exploitation attempts or unauthorized access to industrial control system (ICS) hardware.