detecting-modbus-command-injection-attacks - Detect Modbus Command Injection in ICS
Detects Modbus TCP/RTU command injection through unauthorized writes, anomalous function codes, malformed frames, and deviations from communication baselines.
Tags
Updated: 2026-10-06Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Monitor Modbus traffic
- Build communication baselines
- Detect unauthorized masters
- Detect unauthorized writes
- Detect anomalous function codes
- Detect malformed frames
- Detect write-rate anomalies
- Generate Modbus alerts
Inputs
- Modbus TCP/RTU network traffic
- Modbus communication baseline
- PLC programming documentation
- Register range definitions
- Function code definitions
Outputs
- Modbus security alerts
- Baseline loading status
- Detected anomaly records
Requirements
- Network SPAN/TAP access
- Suricata, Zeek, or commercial OT IDS
- Enabled Modbus protocol parsers
- Python with Scapy installed
- Access to PLC programming documentation