Read operations against industrial protocols reveal reconnaissance. Write operations reveal intent. Program upload attempts reveal sophisticated, targeted attack capability.
Currently otpot logs connection metadata but does not specifically flag or capture the payload of write operations and program upload attempts across OT protocols.
What to capture and flag:
- Modbus — Write Single Coil (FC05), Write Single Register (FC06), Write Multiple Coils (FC15), Write Multiple Registers (FC16). Log the register address, value written, and raw payload.
- S7Comm — Write Variable attempts, Download Block attempts (function code 0x1A — this is ladder logic upload), Start Download (0x1B), End Download (0x1C). A Download Block attempt is the closest network-accessible equivalent to a Stuxnet-style program injection.
- EtherNet/IP CIP — Set Attribute Single/Multiple requests, Forward Open with output data (attempting to control outputs directly).
Why this matters:
Most ICS scanning is read-only reconnaissance. An attacker who sends write commands — especially a Download Block to S7Comm or a Forward Open with output data to EtherNet/IP — has moved from reconnaissance to attempted manipulation. That transition is the most important moment in an OT attack and currently goes unlabeled in otpot's logging.
Capturing the payload of a ladder logic upload attempt, even to a honeypot, could yield actual malicious PLC code — potentially the first open source capture of in-the-wild ICS attack payloads.
Reference: INDUSTROYER, Stuxnet, and TRITON all used native OT protocol write operations as their primary attack vector against physical process equipment.
Read operations against industrial protocols reveal reconnaissance. Write operations reveal intent. Program upload attempts reveal sophisticated, targeted attack capability.
Currently otpot logs connection metadata but does not specifically flag or capture the payload of write operations and program upload attempts across OT protocols.
What to capture and flag:
Why this matters:
Most ICS scanning is read-only reconnaissance. An attacker who sends write commands — especially a Download Block to S7Comm or a Forward Open with output data to EtherNet/IP — has moved from reconnaissance to attempted manipulation. That transition is the most important moment in an OT attack and currently goes unlabeled in otpot's logging.
Capturing the payload of a ladder logic upload attempt, even to a honeypot, could yield actual malicious PLC code — potentially the first open source capture of in-the-wild ICS attack payloads.
Reference: INDUSTROYER, Stuxnet, and TRITON all used native OT protocol write operations as their primary attack vector against physical process equipment.