S7comm Traffic Anomaly Indicating Off-Hours or Scripted Activity
Detects S7comm protocol network connections (default port 102) initiated outside of standard business hours (06:00 to 18:00). S7comm is the proprietary protocol used by Siemens S7 PLCs; unauthorized or anomalous interaction with these devices, especially during off-hours, may indicate reconnaissance or manipulation of industrial control systems.
Sigma
