Vendor-associated
Omron FINS
Omron's factory interface network service used for memory access, program operations and controller status across its controller families.
9600 (UDP/TCP)UDP / TCPEncryption: No
How it works
Command frames address a network/node/unit triple and carry a command code operating on controller memory areas.
Communication patternHMI / engineering client → controller node on 9600.
Fact sheet
TransportUDP / TCP
Ports9600 (UDP/TCP)
AuthenticationNone
PurdueLevel 2 – Level 1
EnvironmentsOmron controller environments
DevicesPLC, HMI, Engineering workstation
IndustriesManufacturing, Food & Beverage
Why should I care?
Understanding Omron FINS is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Memory area read/write
- Program area access
- Run/Stop control
- Status read
Security concerns
- Unauthenticated memory and mode operations
- Broadcast discovery can enumerate controllers
What normal looks like
- Known HMI clients performing memory reads
What deserves attention
- Run/Stop commands from unexpected hosts
- Program area access outside change windows
Hunting ideas
- unauthorized-plc-programming
- controller-mode-change
Defensive controls
- Restrict 9600 to named hosts
- Alert on mode change commands
Related ATT&CK for ICS techniques
T0858T0843
Sources & further reading