Skip to main content
OT Atlas

Vendor-associated

Mitsubishi MC Protocol

MELSEC Communication protocol for device memory access between MELSEC controllers and host systems; port assignment is configuration dependent rather than fixed.

Configurable (commonly 5007 / 5562 depending on configuration)TCP / UDPEncryption: No

How it works

A host issues device read/write commands against controller memory areas over a configured Ethernet port.

Communication patternHost / HMI → MELSEC controller on the configured port.

Fact sheet

TransportTCP / UDP
PortsConfigurable (commonly 5007 / 5562 depending on configuration)
AuthenticationImplementation dependent
PurdueLevel 2 – Level 1
EnvironmentsMitsubishi MELSEC environments
DevicesPLC, HMI, SCADA
IndustriesManufacturing, Automotive

Why should I care?

Understanding Mitsubishi MC Protocol is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.

Key functions and operations

  • Device memory read/write
  • Remote run/stop
  • Status read

Security concerns

  • Remote run/stop where enabled
  • Port variability complicates firewall rules and monitoring baselines

What normal looks like

  • A documented port per controller with known clients

What deserves attention

  • Clients other than the documented HMI/SCADA
  • Remote stop commands

Hunting ideas

  • controller-mode-change
  • protocol-write-activity

Defensive controls

  • Document configured ports in the asset inventory
  • Disable remote run/stop where the process allows

Related ATT&CK for ICS techniques

T0858
An industrial network topology connecting controllers, HMIs, servers, cloud systems, field instruments and robotic equipment that may exchange Mitsubishi MC Protocol traffic.
Protocols are relationships between devices — baseline who talks to whom before you alert on anything.

Sources & further reading