Connection attempt – CR Connect Request detected
The rule detects TCP traffic containing specific byte sequences in the payload that correspond to a Connection Request (CR) Connect Request. This rule could be useful for monitoring and detecting certain types of communication attempts related to Siemens SIMATIC S7 devices or systems using the CR protocol.
ID Number
4000015
Signature
alert tcp any any -> any 102 (msg:"Connection attempt - CR Connect Request detected";content:"|03 00|";offset:0;depth:2;content:"|e0 00 00|";offset:5;depth:3;sid:4000015;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the connection. If the connection was approved - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.