Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
3
1
1
Platforms
2
1
Products / Services
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
Detects S7comm protocol network connections (default port 102) initiated outside of standard business hours (06:00 to 18:00). S7comm is the proprietary protocol used by Siemens S7 PLCs; unauthorized or anomalous interaction with these devices, especially during off-hours, may indicate reconnaissance or manipulation of industrial control systems.
Detects S7comm 'PUT' or 'Write Var' commands directed at a PLC via port 102 when no authorized maintenance window is active, indicating potentially unauthorized industrial control system (ICS) modifications.
This rule detects network connections using the S7comm protocol (typically on TCP port 102) directed at Siemens S7 PLCs from source hosts that are not identified as authorized engineering workstations. This behavior may indicate unauthorized access, reconnaissance, or lateral movement within an Industrial Control System (ICS) environment.