S7 – Read SZL
The rule is related to Siemens S7 communication protocol, which is used for communication with Siemens PLCs. Each command serves a specific purpose in interacting with the PLC. "S7 - Read SZL" command is used to read specific information from the system data area of the PLC. It allows querying information about the CPU and memory status, among other parameters.
ID Number
4000017
Signature
alert tcp any any -> any 102 (msg:"S7 - Read SZL";content:"|03 00|";offset:0;depth:2;content:"|32 07 00|";offset:7;depth:3;content:"|00 01 12 04 11 44 01 00|";offset:17;depth:8;sid:4000017;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the connection. If the connection was approved as a network engineer accessing the PLC - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.