S7 – Upload
The rule is related to Siemens S7 communication protocol, which is used for communication with Siemens PLCs. Each command serves a specific purpose in interacting with the PLC. "S7 - Upload" command is used to transfer data from the PLC to the client as part of an upload process. This could include PLC program code, data blocks, or other configurations.
ID Number
4000031
Signature
alert tcp any any -> any 102 (msg:"S7 - Upload";content:"|03 00|";offset:0;depth:2;content:"|32 01|";offset:7;depth:2;content:"|1e|";offset:17;depth:1;sid:4000031;)
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the connection. If the connection was approved as a network engineer accessing the PLC - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.