<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-plc-firmware-manipulation
description: >-
  Detect unauthorized PLC firmware modifications through integrity monitoring, firmware
  extraction and comparison, checksum validation, and behavioral analysis of compromised
  programmable logic controllers.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - plc
  - firmware
  - integrity-monitoring
  - ics
  - scada
  - rootkit
  - stuxnet
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0839", "T0873", "T0857"]
  nist-csf: ["DE.CM-7", "PR.DS-6"]
  iec-62443: ["SR 3.4", "SR 7.7"]
  uuid: a1b2c3d4-1002-4000-a002-000000000002
---

# Detecting PLC Firmware Manipulation

## Overview

PLC firmware manipulation enables persistent, stealthy control over physical processes.
Attackers can modify ladder logic, inject rootkits into PLC firmware, or replace runtime
programs to alter process behavior while reporting normal values to HMI/SCADA. Detection
requires firmware integrity baselines, periodic extraction and comparison, and behavioral
monitoring for process anomalies inconsistent with reported values.

Mode: `[MODE: BLUE]` for integrity monitoring; `[MODE: RED]` for firmware attack simulation.

## Prerequisites

| Requirement | Details |
|---|---|
| Vendor-specific PLC programming tools (Siemens TIA Portal, Rockwell Studio 5000, etc.) | Required |
| Network access to PLC management ports (S7comm/102, EtherNet/IP/44818) | Required |
| Known-good firmware images for baseline comparison | Required |
| Isolated lab environment for active firmware testing | Required |
| `binwalk`, `strings`, `sha256sum` for firmware analysis | Required |

## Key Concepts

### Firmware Extraction Methods

```bash
# Siemens S7-300/400 — extract via snap7
python3 -c "
import snap7
client = snap7.client.Client()
client.connect('10.0.0.1', 0, 1)
# Read system state list
state = client.get_cpu_state()
print(f'CPU State: {state}')
# Read block list for integrity check
blocks = client.list_blocks()
print(f'OB blocks: {blocks.OBCount}, FB: {blocks.FBCount}, DB: {blocks.DBCount}')
"

# Extract PLC project file for comparison
# Siemens: upload project via TIA Portal CLI
# Rockwell: use RSLogix upload function

# Generic firmware dump via network protocol
nmap --script s7-info -p 102 10.0.0.1
nmap --script modbus-discover -p 502 10.0.0.1
```

### Integrity Baseline Creation

```bash
# Create checksums of known-good firmware
sha256sum firmware_v2.1_golden.bin > firmware_baseline.sha256

# Extract and hash PLC program blocks individually
for block in OB1 FB1 FB2 DB1 DB10; do
  sha256sum "plc_blocks/${block}.awl" >> block_baseline.sha256
done

# Firmware binary analysis
binwalk firmware_dump.bin
strings -n 8 firmware_dump.bin | grep -iE "version|vendor|password|key"
```

### Detection via Network Monitoring

```bash
# Zeek — detect S7comm program upload/download
zeek -r capture.pcap s7comm

# Suricata rules for firmware manipulation indicators
# Alert on S7comm CPU stop command
cat << 'EOF'
alert tcp any any -> $ICS_NET 102 ( \
  msg:"S7COMM - CPU Stop Command Detected"; \
  flow:established,to_server; \
  content:"|03 00|"; depth:2; \
  content:"|29|"; offset:17; depth:1; \
  sid:4001001; rev:1; \
  metadata:mitre_attack_technique T0857;)
EOF

# Alert on S7comm program download (firmware write)
cat << 'EOF'
alert tcp any any -> $ICS_NET 102 ( \
  msg:"S7COMM - Program Download to PLC"; \
  flow:established,to_server; \
  content:"|03 00|"; depth:2; \
  content:"|1a|"; offset:17; depth:1; \
  sid:4001002; rev:1; \
  metadata:mitre_attack_technique T0839;)
EOF
```

### Behavioral Detection

```bash
# Monitor for process value inconsistencies
# Compare physical sensor readings with PLC-reported values
# Stuxnet-style attacks report normal values while altering physical process

# Zeek script to detect register value anomalies
# Compare current holding register values against known operational ranges
tshark -r capture.pcap -Y "modbus.func_code == 3" \
  -T fields -e frame.time -e modbus.regval_uint16 | \
  awk -F'\t' '{
    if ($2+0 > 1000 || $2+0 < 0)
      print "ANOMALY:", $0
  }'
```

## Workflow

### Step 1: Establish Firmware Baseline

```bash
# Extract current firmware from all PLCs
for plc in 10.0.0.1 10.0.0.2 10.0.0.3; do
  python3 extract_plc_project.py --target "$plc" --output "baseline/${plc}.bin"
  sha256sum "baseline/${plc}.bin" >> firmware_manifest.sha256
done
```

### Step 2: Schedule Periodic Integrity Checks

```bash
# Compare current firmware against baseline
sha256sum -c firmware_manifest.sha256
# Non-zero exit = firmware modification detected
```

### Step 3: Monitor for Upload Events

```bash
# Continuous monitoring for PLC programming operations
suricata -c /etc/suricata/suricata.yaml -i eth1 \
  -S /etc/suricata/rules/ics_firmware.rules
```

## Verification

- [ ] Golden firmware images stored offline (air-gapped)
- [ ] SHA-256 checksums generated for all PLC program blocks
- [ ] Periodic integrity checks automated (weekly minimum)
- [ ] Network monitoring detects PLC upload/download operations
- [ ] Engineering workstation access logged and alerted
- [ ] Physical process value cross-validation implemented

## Detection Opportunities

- PLC program block upload outside maintenance windows → firmware manipulation
- S7comm/EtherNet-IP write commands from non-engineering workstations → compromise
- CPU mode changes (RUN→STOP→RUN) without change ticket → unauthorized modification
- Process values diverging from physical sensor cross-checks → rootkit hiding changes
- New or modified OB/FB/DB blocks not matching golden baseline → logic injection

```yaml
title: Plc Firmware Manipulation Detection
id: 63e2b64c-a706-44bb-b55c-af38cbab7e51
status: experimental
description: Detects suspicious activity related to detecting plc firmware manipulation techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*detecting*plc*"
  condition: selection
level: medium
tags:
  - attack.t0839
  - attack.t0873
  - attack.t0857
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- MITRE ATT&CK for ICS: T0839 (Module Firmware), T0873 (Project File Infection)
- Stuxnet technical analysis (Langner, Symantec W32.Stuxnet Dossier)
- IEC 62443-3-3 SR 3.4: Software and Information Integrity
- NIST SP 800-82 Rev 3 §6.2.7: PLC Security
