<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# ICS Protocol Reference

Protocol specifications, common vulnerabilities, and detection signatures.

## Modbus TCP (Port 502)
- No authentication or encryption by design
- Function codes: Read Coils (01), Read Registers (03), Write Single (06), Write Multiple (16)
- Attack: Unauthorized write to control registers
- Detection: Monitor for write function codes from unexpected sources

## DNP3 (Port 20000)
- Primarily SCADA and utilities
- Secure Authentication v5 adds HMAC-based auth
- Attack: Unsolicited response injection
- Detection: Sequence number anomalies, unauthorized function codes

## OPC-UA (Port 4840)
- Modern, includes built-in security (X.509 certs, encryption)
- Attack: Certificate trust exploitation, discovery service abuse
- Detection: Monitor for anonymous connections, excessive browse operations

## EtherNet/IP (Port 44818)
- CIP protocol over Ethernet
- Attack: Unauthorized CIP service requests
- Detection: Monitor for firmware upload/download operations

## S7comm (Port 102)
- Siemens proprietary (S7-300/400/1500)
- Minimal authentication in older versions
- Attack: PLC stop/start, program upload/download
- Detection: Monitor for CPU state changes, program transfers
