Open / standardized
AMQP
A general-purpose messaging protocol used industrially where richer routing, transactions and durability are needed than MQTT provides.
5672/TCP (plain), 5671/TCP (TLS)TCPEncryption: Optional
How it works
Clients open a connection with channels and exchange messages via brokers and exchanges with defined routing keys.
Communication patternProducer → exchange → queue → consumer.
Fact sheet
TransportTCP
Ports5672/TCP (plain), 5671/TCP (TLS)
AuthenticationYes
PurdueLevel 3.5 and above
EnvironmentsIndustrial data platforms, Cloud ingestion
DevicesEdge gateway, Message broker, Analytics platform
IndustriesManufacturing, Oil & Gas, Data Centers
Why should I care?
Understanding AMQP is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Publish
- Consume
- Acknowledge
- Transactional delivery
Security concerns
- Plaintext 5672 in internal deployments
- Credential sprawl across integrations
What normal looks like
- TLS with named service credentials
What deserves attention
- New consumers on operational queues
- Plaintext sessions crossing zone boundaries
Hunting ideas
- historian-data-exfiltration
Defensive controls
- TLS and per-service credentials
- DMZ placement for cross-zone messaging
Related ATT&CK for ICS techniques
T0811
Sources & further reading