Vendor-associated
S7 Communication (S7comm / S7comm-plus)
The communication used between Siemens SIMATIC controllers, HMIs and engineering software over ISO-on-TCP port 102. Newer S7comm-plus generations add integrity and anti-replay protections that older S7-300/400 traffic lacks.
102/TCPTCP (ISO-on-TCP)Encryption: Depends on profile
How it works
A client sets up an ISO-on-TCP connection and COTP session, then issues job requests for data access, block operations and diagnostics.
Communication patternEngineering workstation / HMI → controller on 102/TCP.
Fact sheet
TransportTCP (ISO-on-TCP)
Ports102/TCP
AuthenticationImplementation dependent
PurdueLevel 2 – Level 1
EnvironmentsSiemens SIMATIC environments
DevicesPLC, HMI, Engineering workstation
IndustriesManufacturing, Water / Wastewater, Energy
Why should I care?
Understanding S7 Communication (S7comm / S7comm-plus) is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Read / write data blocks
- Upload / download program blocks
- Start / stop CPU
- Read diagnostic buffer
Security concerns
- Block download and CPU mode change are extremely high impact operations
- Older controller families lack strong session protections
- Engineering software compromise is the practical path to controller change
What normal looks like
- HMI performing periodic data-block reads
- Block downloads only from known engineering hosts in change windows
What deserves attention
- Block download or CPU stop from an unexpected host
- Diagnostic buffer reads preceding configuration change
- New 102/TCP client
Hunting ideas
- unauthorized-plc-programming
- controller-logic-changes
- controller-mode-change
Defensive controls
- Restrict 102/TCP to named engineering hosts via conduit rules
- Enable controller protection levels and know-how protection where available
- Alert on any program download
Related ATT&CK for ICS techniques
T0843T0858T0831
Seen in incidents
- stuxnet
Sources & further reading