Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
2
Categories
1
1
1
1
Platforms
1
1
1
Products / Services
1
1
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
Detects instances where a Python interpreter (python.exe or pythonw.exe) loads the 'snap7.dll' library. This library is commonly associated with the 'python-snap7' package, used for communicating with Siemens S7 PLC devices. This behavior is potentially suspicious in OT environments where Python should not be interacting with industrial control system hardware.
Detects unauthorized S7comm 'PUT' or 'Write' operations to Programmable Logic Controller (PLC) data blocks or configuration memory that occur outside of defined maintenance or change windows, specifically when no valid work order is associated with the event.