S7 – Start upload
The rule is related to Siemens S7 communication protocol, which is used for communication with Siemens PLCs. Each command serves a specific purpose in interacting with the PLC. "S7 - Start upload" command signals the beginning of an upload process from the PLC. It prepares the PLC to send specific data (e.g., program code, configuration) to the client (e.g., programming tool) during the upload.
ID Number
4000030
Signature
alert tcp any any -> any 102 (msg:"S7 - Start upload";content:"|03 00|";offset:0;depth:2;content:"|32 01|";offset:7;depth:2;content:"|1d|";offset:17;depth:1;sid:4000030;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the connection. If the connection was approved as a network engineer accessing the PLC - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.