SecureAEye LAB ONLINE · SIG 657 · DET ~41s

← All attacks / Wireless, mobile, IoT and OT/ICS attacks

Modbus/DNP3/S7 protocol abuse

Unauthenticated ICS protocols accept attacker read/write to PLCs

categoryWireless, mobile, IoT and OT/ICS attacksseverityVery Highdetectability (measured in our lab)Mediumlabdetected in lab

Example: FrostyGoop

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1571 · Outbound connection to industrial-protocol ports (Windows / Sysmon EID3)
powershell -NoProfile -ExecutionPolicy Bypass -File C:\lab\e2-port-probe.ps1 -Ports 502,20000,44818 -Technique T1571 -RunId <run-id>
ATT&CK T1571
powershell -NoProfile -ExecutionPolicy Bypass -File C:\lab\e2-port-probe.ps1 -Ports 502,20000,44818 -Technique T1571 -RunId run-2026-10-11-006
ATT&CK T1571 · Outbound connection to industrial-protocol ports (Modbus/DNP3/EtherNet-IP)
sudo /opt/lab/e2-port-probe.sh --target 10.10.10.22 --ports 502,20000,44818 --technique T1571 --run-id <run-id>

+ 2 more test variant(s) in the corpus.

What our lab measured

detected linux · 2026-10-16 · detected in 2s

Detection that fired

  • ✓ Wazuh 100310 (level 8) lab rule — OT-adjacent (Linux): outbound connect() to an industrial protocol port (Modbus/DNP3/EtherNet-IP), from auditd SOCKADDR. ICS refs T0885/T0855.

Plus 3 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~196 incidental alerts/hour — tune against this.

partially detected windows · 2026-10-11

What it looked like in telemetry

Log sourceWhat it means
Sysmon · EID 11Executable file dropped in folder commonly used by malware
Security · EID 4624Non network or service local logon.
Security · EID 4634Non service account logged off.
Security · EID 4672Special privileges assigned to new logon.

Plus 4 stock Wazuh/Sysmon rule(s) in the window.

⚠ Gap: rule 100300 was expected but did not fire in this run — the telemetry above is the hunt surface, not a solved detection.

Background noise in the window: ~391 incidental alerts/hour — tune against this.

5 public Sigma rule(s) also target this technique.

Classification

23 values: 15 reviewed, 3 lab-measured, 4 imported, 1 derived. What do these mean?

Exploitability

Attack vectorWireless, mobile & IoT/OT
Reach (CVSS)Network
Attack complexityLow
Privileges requiredNone
User interactionNone
Attacker skill requiredMedium
Resources requiredLow
Likelihood / prevalenceHigh
MaturityEstablished

Impact & scope

SeverityVery High
ImpactAvailabilityIntegritySafety
EnvironmentOT / ICS
Target asset classNetwork devicePhysical
Kill-chain phase (tactic)Defense Evasion (legacy) (deprecated)Impair Process Control (ICS)

Detection & telemetry

Detectability (measured in our lab)Medium
Detectability (public detection content)None
Noise levelHigh
TestabilityCustom lab test
Data sources (ATT&CK data components)Network Traffic ContentNetwork Traffic Flow

Detection & response

Mitigated by 5

Detected by 2

  • DET0902 attack-detection-strategy
  • 100310 wazuh

Tested by 2

  • lab-custom-e2-ics-port-probe other
  • lab-custom-e2-ics-port-probe-win other

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

RunOutcomeToolPlatformRan at
run-2026-10-02-001detectedotherlinux2026-10-02
run-2026-10-11-006partially-detectedotherwindows2026-10-11
run-2026-10-16-006detectedotherlinux2026-10-16
  • run-2026-10-02-001 — E2 probe for Wazuh rule 100310 (the Linux/auditd sibling of 100300 -- the Windows rule cannot see a Linux connect). Public host Sigma for ICS ports is ~zero, so a fired alert here is evidence that SIEM detectability is not the same thing as public-rule count (the open question in coverage-gap-abbc5171a39f). One TCP connect per port, no protocol payload — it cannot affect a real device, and there is none on the segment.; expected=3 incidental=5 max_level=8 dwell_s=90
  • run-2026-10-11-006 — E2 probe for Wazuh rule 100300 (the Windows/Sysmon sibling of 100310 -- the Linux rule cannot see a Windows connect). Sysmon EID 3 fires on an ESTABLISHED connection, so the probe stands up a transient listener and completes one connection per port on the guest's own labnet IP; no traffic leaves the island and no real device is touched.; expected=0 incidental=10 max_level=15 dwell_s=90
  • run-2026-10-16-006 — E2 probe for Wazuh rule 100310 (the Linux/auditd sibling of 100300 -- the Windows rule cannot see a Linux connect). Public host Sigma for ICS ports is ~zero, so a fired alert here is evidence that SIEM detectability is not the same thing as public-rule count (the open question in coverage-gap-abbc5171a39f). One TCP connect per port, no protocol payload — it cannot affect a real device, and there is none on the segment.; expected=3 incidental=5 max_level=8 dwell_s=90

Framework references

Evidence & sources

  • ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Wireless, mobile, IoT and OT/ICS attacks' table, line 501 of Cyber-Attack-Taxonomy.md
  • ev-0002 (Phase 4 detection lab - detonation runs 2026-10-02) — Lab detonation run-2026-10-02-001 (detected): Wazuh rule(s) 100310 fired on T1571 within the detonation window
    OT-adjacent (Linux): outbound connect() to an industrial protocol port (Modbus/DNP3/EtherNet-IP), from auditd SOCKADDR. ICS refs T0885/T0855.
  • ev-0003 (Phase 4 detection lab - detonation runs 2026-10-11) — Lab detonation run-2026-10-11-006 (partially-detected) for T1571: no alert matched the expected technique
  • ev-0004 (Phase 4 detection lab - detonation runs 2026-10-16) — Lab detonation run-2026-10-16-006 (detected): Wazuh rule(s) 100310 fired on T1571 within the detonation window
    OT-adjacent (Linux): outbound connect() to an industrial protocol port (Modbus/DNP3/EtherNet-IP), from auditd SOCKADDR. ICS refs T0885/T0855.