Open / standardized
IEC 60870-5-104
Telecontrol protocol used between control centres and substations, mainly outside North America. Base standard has no authentication or encryption; IEC 62351 defines security extensions.
2404/TCPTCPEncryption: No
How it works
A controlling station establishes a TCP session with a controlled station and exchanges ASDUs carrying measurements, status and commands identified by information object addresses.
Communication patternControl centre → substation gateway → IEDs.
Fact sheet
Also known asIEC 104
TransportTCP
Ports2404/TCP
AuthenticationNone in base standard
PurdueLevel 2 – Level 1
EnvironmentsEuropean / international electric utilities, Substation to control centre
DevicesRTU, Gateway, SCADA server, IED
IndustriesElectric Power
Why should I care?
Understanding IEC 60870-5-104 is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- General interrogation
- Single/double command
- Set-point command
- Clock synchronisation
- File transfer
Security concerns
- Commands can operate switchgear where the path is reachable and unauthenticated
- Historically used in documented grid attack activity
- Long-lived TCP sessions make anomaly baselining important
What normal looks like
- One controlling station per controlled station
- Periodic interrogation and spontaneous updates
What deserves attention
- A second controlling station connecting
- Command ASDUs outside operational activity
- Clock sync from unexpected hosts
Hunting ideas
- rogue-master-controller
- protocol-write-activity
- unexpected-it-to-ot
Defensive controls
- IEC 62351 protections where supported
- Strict conduit rules per substation
- Substation-level passive monitoring
Related ATT&CK for ICS techniques
T0855T0836T0813
Seen in incidents
- industroyer
Sources & further reading