Legacy
OPC Classic (DA/HDA/AE)
The original Windows COM/DCOM-based OPC family. Functional but firewall-hostile because of dynamic port allocation, and dependent on legacy Windows authentication settings.
135/TCP plus dynamic high portsDCOM over TCPEncryption: NoLegacy
How it works
A client resolves the server through the DCOM endpoint mapper on 135/TCP, then communicates over a dynamically negotiated port.
Communication patternClient → endpoint mapper → dynamic port → OPC server.
Fact sheet
TransportDCOM over TCP
Ports135/TCP plus dynamic high ports
AuthenticationWindows / DCOM
PurdueLevel 3 – Level 2
EnvironmentsLegacy plant integration, Historian collection
DevicesOPC server, Historian, SCADA server, HMI
IndustriesManufacturing, Oil & Gas, Chemical
Why should I care?
Understanding OPC Classic (DA/HDA/AE) is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Browse tags
- Read / write items
- Subscribe to changes
- Historical data access
- Alarms & events
Security concerns
- Dynamic ports encourage overly permissive firewall rules
- Historically deployed with weakened DCOM authentication to 'make it work'
- Runs on Windows hosts that are often out of support
What normal looks like
- A small set of client hosts
- Steady subscription-driven traffic
What deserves attention
- Broad 135/TCP activity across the zone
- New client host binding to OPC servers
- Tag browse floods
Hunting ideas
- unexpected-it-to-ot
- historian-data-exfiltration
Defensive controls
- Migrate to OPC UA where lifecycle allows
- Use an OPC tunneller across zone boundaries instead of opening DCOM
- Restrict to a DMZ collection host
Related ATT&CK for ICS techniques
T0846T0811
Sources & further reading