Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
2
1
1
Platforms
2
1
Products / Services
2
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
This rule detects network connections using the S7comm protocol (typically on TCP port 102) directed at Siemens S7 PLCs from source hosts that are not identified as authorized engineering workstations. This behavior may indicate unauthorized access, reconnaissance, or lateral movement within an Industrial Control System (ICS) environment.
Detects unauthorized network sessions targeting Siemens S7 PLCs. The rule specifically identifies unauthenticated S7comm protocol traffic on TCP port 102 and the usage of default SNMP community strings ('public' or 'private') on port 161, which are indicative of exploitation attempts or unauthorized access to industrial control system (ICS) hardware.