Vendor-associated
Mitsubishi MC Protocol
MELSEC Communication protocol for device memory access between MELSEC controllers and host systems; port assignment is configuration dependent rather than fixed.
Configurable (commonly 5007 / 5562 depending on configuration)TCP / UDPEncryption: No
How it works
A host issues device read/write commands against controller memory areas over a configured Ethernet port.
Communication patternHost / HMI → MELSEC controller on the configured port.
Fact sheet
TransportTCP / UDP
PortsConfigurable (commonly 5007 / 5562 depending on configuration)
AuthenticationImplementation dependent
PurdueLevel 2 – Level 1
EnvironmentsMitsubishi MELSEC environments
DevicesPLC, HMI, SCADA
IndustriesManufacturing, Automotive
Why should I care?
Understanding Mitsubishi MC Protocol is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Device memory read/write
- Remote run/stop
- Status read
Security concerns
- Remote run/stop where enabled
- Port variability complicates firewall rules and monitoring baselines
What normal looks like
- A documented port per controller with known clients
What deserves attention
- Clients other than the documented HMI/SCADA
- Remote stop commands
Hunting ideas
- controller-mode-change
- protocol-write-activity
Defensive controls
- Document configured ports in the asset inventory
- Disable remote run/stop where the process allows
Related ATT&CK for ICS techniques
T0858
Sources & further reading