<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-unauthorized-plc-programming
description: >-
  Monitor and detect unauthorized logic changes to PLCs using network-based
  protocol analysis, PLC program checksums, change detection agents, and
  comparison against golden-image baselines.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - plc
  - ics
  - change-detection
  - scada
  - firmware-integrity
  - ot-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0845", "T0873", "T0843"]
  nist-csf: ["DE.CM-7", "PR.DS-6"]
  iec-62443: ["SR 3.4", "SR 7.6"]
  uuid: a1b2c3d4-1001-4000-a001-000000000004
---

# Detecting Unauthorized PLC Programming

## Overview

PLC program integrity is the foundation of process safety. Unauthorized logic
changes — whether from malware like TRITON/Stuxnet or insider threats — can
manipulate physical processes with catastrophic consequences. Detection requires
network monitoring, program checksumming, and baseline comparison.

Mode: `[MODE: BLUE]` for monitoring; `[MODE: INCIDENT]` for investigation.

## Prerequisites

| Requirement | Details |
|---|---|
| Network tap/SPAN on engineering workstation to PLC path | Required |
| Golden-image backups of all PLC programs (exported and checksummed) | Required |
| Wireshark/Zeek with ICS dissectors (S7comm, EtherNet/IP, Modbus) | Required |
| PLC vendor software for program comparison (TIA Portal, RSLogix, Unity Pro) | Required |
| OT change detection platform (Claroty, Dragos, Nozomi) recommended | Required |
| SIEM integration for alerting on programming protocol usage | Required |

## Key Concepts

### PLC Programming Protocols

```yaml
siemens_s7:
  port: 102
  functions: [Download Block (0x1a), Upload Block (0x1d), Delete (0x1c), Stop (0x29)]

rockwell_cip:
  port: 44818
  functions: [Program Upload/Download, Online Edit, Flash Update, Mode Change]

schneider_umas:
  port: 502
  functions: [Upload/Download Program, Start/Stop PLC, Memory Read/Write]
```

### Network-Based Detection

```bash
# Detect S7comm programming operations
tshark -i eth1 -Y "s7comm.param.func == 0x1a || s7comm.param.func == 0x1d" \
  -T fields -e frame.time -e ip.src -e ip.dst -e s7comm.param.func

# Detect EtherNet/IP programming
tshark -i eth1 -Y "enip && cip.service == 0x52" \
  -T fields -e frame.time -e ip.src -e ip.dst

# Monitor unauthorized hosts on PLC programming ports
tshark -i eth1 -Y "(tcp.dstport == 102 || tcp.dstport == 44818) && !(ip.src == 10.10.1.50)" \
  -T fields -e ip.src -e ip.dst -e tcp.dstport
```

### PLC Program Checksumming

```bash
python3 -c "
import snap7, hashlib
plc = snap7.client.Client()
plc.connect('10.10.0.50', 0, 1)
data = plc.upload(snap7.types.BlockType.OB, 1)
print(f'OB1 SHA256: {hashlib.sha256(data).hexdigest()}')
plc.disconnect()"

# Suricata rule for programming detection
# alert tcp any any -> \$ICS_NET 102 (msg:"S7 Download Block"; content:"|32 01|"; content:"|1a|"; offset:17; sid:5000010;)
```

## Workflow

### Step 1: Establish Baselines

```bash
python3 export_plc.py --inventory plc_list.csv --output /secure/baselines/
sha256sum /secure/baselines/*.bin > /secure/baselines/checksums.sha256
```

### Step 2: Deploy Monitoring

```bash
zeek -i eth1 detect_s7_programming.zeek &
suricata -i eth1 -S /etc/suricata/rules/ics_programming.rules &
```

### Step 3: Scheduled Checks

```bash
echo "0 6 * * * /opt/ics-tools/verify_checksums.sh >> /var/log/plc_integrity.log" | crontab -
```

## Verification

- [ ] Golden-image baselines for all PLCs
- [ ] SHA-256 checksums in tamper-proof storage
- [ ] Network monitoring on engineering segments
- [ ] Suricata/Zeek rules active
- [ ] Unauthorized source alerts tested
- [ ] Scheduled integrity checks running
- [ ] Change management validates programming

## Detection Opportunities

- Programming from non-EWS → compromised host
- Programming outside change windows → unauthorized
- PLC checksum mismatch → logic manipulation
- Multiple stop/start commands → sabotage
- New S7comm/CIP from IT → lateral movement

```yaml
title: Unauthorized Plc Programming Detection
id: 90569ee3-42ba-4bd3-8bc6-36d7932ebb5e
status: experimental
description: Detects suspicious activity related to detecting unauthorized plc programming techniques in ot ics security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*detecting*unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t0845
  - attack.t0873
  - attack.t0843
  - attack.lateral_movement
falsepositives:
  - Industrial control system maintenance by authorized engineering staff
```

## References

- MITRE ATT&CK for ICS: T0845, T0873
- NIST SP 800-82 Rev 3: Guide to OT Security
- IEC 62443-3-3 SR 3.4: Software Integrity
- CISA Alert: TRITON Malware Analysis
