Connection attempt – CR Connect Request detected
The rule detects TCP traffic containing specific byte sequences in the payload that correspond to a Connection Request (CR) Connect Request. This rule could be useful for monitoring and detecting certain types of communication attempts related to Siemens SIMATIC S7 devices or systems using the CR protocol.
S7 Setup communication
The rule is related to Siemens S7 communication protocol, which is used for communication with Siemens PLCs. Each command serves a specific purpose in interacting with the PLC. "S7 Setup communication" command is typically sent at the beginning of the communication session between the client and the PLC to establish communication parameters, such as the communication mode, data format, and other settings necessary for successful data exchange.
S7 – Upload
The rule is related to Siemens S7 communication protocol, which is used for communication with Siemens PLCs. Each command serves a specific purpose in interacting with the PLC. "S7 - Upload" command is used to transfer data from the PLC to the client as part of an upload process. This could include PLC program code, data blocks, or other configurations.
S7 – Start upload
The rule is related to Siemens S7 communication protocol, which is used for communication with Siemens PLCs. Each command serves a specific purpose in interacting with the PLC. "S7 - Start upload" command signals the beginning of an upload process from the PLC. It prepares the PLC to send specific data (e.g., program code, configuration) to the client (e.g., programming tool) during the upload.
S7 – Request Security functions/Set PLC session password
The rule is related to Siemens S7 communication protocol, which is used for communication with Siemens PLCs. Each command serves a specific purpose in interacting with the PLC. "S7 - Request Security functions/Set PLC session password" command initiates the setup of security functions or allows setting a password for the PLC session. It is used to enable security features in the communication between the client (e.g., HMI, SCADA system) and the PLC to protect against unauthorized access or tampering.