S7 – End upload
The rule is related to Siemens S7 communication protocol, which is used for communication with Siemens PLCs. Each command serves a specific purpose in interacting with the PLC. "S7 - End upload" command is used to terminate an ongoing upload process from the PLC. It is typically sent after a successful upload or when there is a need to cancel the upload process.
ID Number
4000032
Signature
alert tcp any any -> any 102 (msg:"S7 - End upload";content:"|03 00|";offset:0;depth:2;content:"|32 01|";offset:7;depth:2;content:"|1f|";offset:17;dep
MITRE ATT&CK Technique
-
Severity
Low
Recommendations/Investigative actions
Authorize the connection. If the connection was approved as a network engineer accessing the PLC - archive and baseline the rule. If not - check the connection and investigate the relevant IP address.