<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Unauthorized PLC Programming — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-unauthorized-plc-programming.

## Tools

### `snap7`

S7 PLC communication

**Usage:**
```bash
import snap7; plc.connect(host,0,1)
```

**Key Flags:**
  - upload(): read blocks
  - get_cpu_info(): metadata

---

### `tshark`

ICS field extraction

**Usage:**
```bash
tshark -r cap.pcap -Y s7comm
```

**Key Flags:**
  - -Y: ICS filter
  - -T fields: structured

---

### `zeek`

Network ICS analysis

**Usage:**
```bash
zeek -i eth1 detect_s7.zeek
```

**Key Flags:**
  - Custom scripts
  - NOTICE alerting

---

## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Never execute write operations against production ICS without explicit authorization

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- NIST SP 800-82: Guide to OT Security
