detecting-modbus-command-injection-attacks

# Detecting Modbus Command Injection Attacks ## When to Use - When deploying intrusion detection for environments using Modbus TCP (port 502) or Modbus RTU - When investigating suspected unauthorized modifications to PLC registers or coils - When building detection analytics for OT SOC monitoring Modbus-heavy environments - When responding to FrostyGoop-style attacks that leverage Modbus TCP for operational impact - When performing baseline validation after a suspected compromise of a Modbus master **Do not use** for detecting attacks on non-Modbus protocols (see detecting-dnp3-protocol-anomalies for DNP3), for general IT network intrusion detection, or for Modbus device configuration (see performing-ot-vulnerability-scanning-safely). ## Prerequisites - Network SPAN/TAP on the segment carrying Modbus TCP traffic (typically port 502) - Baseline of normal Modbus communication patterns (masters, slaves, function codes, register ranges, polling intervals) - Suricata, Zeek, or commercial OT IDS deployed with Modbus protocol parsers enabled - Understanding of Modbus function codes used in the environment (read vs write operations) - Access to PLC programming documentation to validate expected register ranges ## Workflow ### Step 1: Build Modbus Communication Baseline Capture and analyze normal Modbus traffic to establish what constitutes legitimate communication patterns. ```python #!/usr/bin/env python3 """Modbus Command Injection Detector. Monitors Modbus TCP traffic fo...