Skip to main content

Open / standardized

AMQP

A general-purpose messaging protocol used industrially where richer routing, transactions and durability are needed than MQTT provides.

5672/TCP (plain), 5671/TCP (TLS)TCPEncryption: Optional

How it works

Clients open a connection with channels and exchange messages via brokers and exchanges with defined routing keys.

Communication patternProducer → exchange → queue → consumer.

Fact sheet

TransportTCP
Ports5672/TCP (plain), 5671/TCP (TLS)
AuthenticationYes
PurdueLevel 3.5 and above
EnvironmentsIndustrial data platforms, Cloud ingestion
DevicesEdge gateway, Message broker, Analytics platform
IndustriesManufacturing, Oil & Gas, Data Centers

Why should I care?

Understanding AMQP is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.

Key functions and operations

  • Publish
  • Consume
  • Acknowledge
  • Transactional delivery

Security concerns

  • Plaintext 5672 in internal deployments
  • Credential sprawl across integrations

What normal looks like

  • TLS with named service credentials

What deserves attention

  • New consumers on operational queues
  • Plaintext sessions crossing zone boundaries

Hunting ideas

  • historian-data-exfiltration

Defensive controls

  • TLS and per-service credentials
  • DMZ placement for cross-zone messaging

Related ATT&CK for ICS techniques

T0811