id: allen-bradley-micro800-detect

info:
  name: Allen-Bradley Micro800 Series PLC - Detect
  author: biero-el-corridor
  severity: info
  description: |
    Detected Allen-Bradley (Rockwell Automation) Micro800 series PLCs by identifying the 2080- model prefix via the EtherNet/IP CIP protocol over port 44818. The Micro800 series is a compact PLC family widely used in industrial automation and control systems.
  metadata:
    shodan-query: 'port:44818 "Vendor ID: Rockwell Automation/Allen-Bradley"'
  tags: ics,allen-bradley,micro800,detect,network,tcp

tcp:
  - inputs:
      - data: "630000000000000000000000000000000000000000000000"
        type: hex
        read: 200
        name: info

    host:
      - "{{Hostname}}"
    port: 44818
    read-size: 1024

    matchers:
      - type: binary
        part: info
        binary:
          - "323038302d"
# digest: 4a0a0047304502200f1f02413b97eb582206cd536b67048f48b8908a4b48177e684b47880a5788ba022100d0e9a7e64010832accd228a593768921d5251c2605a0d84953cad9bb0ae81533:922c64590222798bb761d5b6d8e72950