detecting-modbus-command-injection-attacks - Detect Modbus Command Injection Attacks
Detect Modbus TCP/RTU command injection in ICS by monitoring unauthorized writes, anomalous function codes, malformed frames, and communication baseline deviations.
Tags
Updated: 2026-10-07Capabilities
Typical Inputs
Typical Outputs
What this skill does
- Monitor Modbus traffic
- Detect unauthorized masters
- Detect unauthorized writes
- Detect anomalous function codes
- Detect malformed frames
- Detect write floods
- Compare communication baselines
Inputs
- Modbus TCP/RTU traffic
- Modbus communication baseline
- PLC programming documentation
- Authorized master definitions
- Register range definitions
Outputs
- Modbus anomaly alerts
- Unauthorized write alerts
- Communication baseline status
Requirements
- Network SPAN/TAP access
- Suricata, Zeek, or commercial OT IDS
- Enabled Modbus protocol parsers
- Modbus function code knowledge