Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
3
Categories
2
2
1
1
Platforms
3
1
Products / Services
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
Detects network connections using the S7comm protocol (port 102) targeting Programmable Logic Controllers (PLCs) originating from IP addresses not present in the defined allowlist of authorized engineering workstations. This behavior may indicate unauthorized access, reconnaissance, or malicious activity within an Industrial Control System (ICS) environment.
Detects unauthorized S7comm 'PUT' or 'Write' operations to Programmable Logic Controller (PLC) data blocks or configuration memory that occur outside of defined maintenance or change windows, specifically when no valid work order is associated with the event.
Detects S7comm 'GET' or 'Read' operations directed at Programmable Logic Controller (PLC) data areas such as Data Blocks or Ladder Logic from unauthorized IP addresses. This activity is indicative of industrial reconnaissance or unauthorized interaction with control systems.