S7 – Read SZL ID=0x001c
The rule is related to Siemens S7 communication protocol, which is used for communication with Siemens PLCs. Each command serves a specific purpose in interacting with the PLC. "S7 - Read SZL ID=0x001c" command requests the PLC to return the system data with ID 0x001c. The ID refers to a specific data record in the SZL area that contains predefined data.
ID Number
4000019
Signature
alert tcp any any -> any 102 (msg:"S7 - Read SZL ID=0x001c";content:"|03 00|";offset:0;depth:2;content:"|32 07 00|";offset:7;depth:3;content:"|00 01 12 04 11 44 01 00|";offset:17;depth:8;content:"|1c 00|";offset:30;depth:2;sid:4000019;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the connection. If the connection was approved as a network engineer accessing the PLC - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.