Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1 detection
Filters
Last updated
All Time
Detection languages
1
Contributors
1
Categories
1
1
Platforms
1
Products / Services
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects network connections using the S7comm protocol (port 102) targeting Programmable Logic Controllers (PLCs) originating from IP addresses not present in the defined allowlist of authorized engineering workstations. This behavior may indicate unauthorized access, reconnaissance, or malicious activity within an Industrial Control System (ICS) environment.
