Control
Programmable Logic Controller (PLC)
A ruggedised industrial computer that executes deterministic control logic against field I/O.
What it does
Reads sensors, runs scan-cycle logic, drives outputs such as valves, motors and drives.
Typically locatedControl cabinets on the plant floor, substations, pump stations and skids.
At a glance
Why should I care?
Programmable Logic Controller sits at Level 1. Compromise here is not just a data problem — it changes what the physical process does or what operators can see and control.
Common security problems
- Unauthenticated programming paths in older families
- Run/Program keyswitch left in remote-programmable state
- Firmware that is years behind vendor releases due to outage constraints
- Flat networks that expose controllers well beyond their process peers
If it is compromised
- Unauthorised logic change can alter physical process behaviour
- Loss of control or loss of view for operators
- Potential equipment damage or unsafe process state depending on the process
What to monitor
- Program download / upload events
- CPU mode changes (Run / Program / Stop)
- New clients speaking controller protocols
- Checksum or project comparison against a known-good baseline
How to defend it
- Restrict controller protocols to named engineering hosts through conduit rules
- Enable controller access protection features supported by the platform
- Keep validated logic backups and compare periodically
- Physically secure cabinets and keyswitches
Hunting
Hunt ideas for this component
Intermediate
Unauthorized PLC Programming
Identify programming or configuration operations against controllers that were not performed by an authorised engineer in an approved change window.
Advanced
Unexpected Controller Logic Changes
Detect differences between the running controller logic and the approved engineering baseline.
Foundational
Unexpected Controller Mode Change
Find controllers transitioning between Run, Program, Stop or remote/local states without an approved reason.
Related
Protocols this component speaks
Open / standardized
Modbus TCP
502/TCP
Industry consortium
EtherNet/IP
44818/TCP (explicit), 2222/UDP (implicit I/O)
Industry consortium
PROFINET
34962–34964/UDP; 102/TCP for related engineering
Open / standardized
PROFINET DCP
N/A — layer 2, broadcast within the subnet
Vendor-associated
S7 Communication (S7comm / S7comm-plus)
102/TCP
Vendor proprietary
UMAS
502/TCP (Modbus function code 90 / 0x5A)
Vendor proprietary
PCCC / CSP
2222/TCP (CSP), 44818/TCP when tunnelled in CIP
Vendor proprietary
PCOM
20256/TCP (PCOM), 20257/TCP (secondary), 5900/TCP for embedded VNC
Vendor-associated
Omron FINS
9600 (UDP/TCP)
Vendor-associated
Mitsubishi MC Protocol
Configurable (commonly 5007 / 5562 depending on configuration)