S7 Setup communication
The rule is related to Siemens S7 communication protocol, which is used for communication with Siemens PLCs. Each command serves a specific purpose in interacting with the PLC. "S7 Setup communication" command is typically sent at the beginning of the communication session between the client and the PLC to establish communication parameters, such as the communication mode, data format, and other settings necessary for successful data exchange.
ID Number
4000016
Signature
alert tcp any any -> any 102 (msg:"S7 Setup communication";content:"|03 00|";offset:0;depth:2;content:"|32 01 00|";offset:7;depth:3;content:"|f0|";offset:17;depth:1;sid:4000016;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the connection. If the connection was approved as a network engineer accessing the PLC - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.