id: schneider-modicon-340-detect

info:
  name: Schneider Electric Modicon 340 Series PLC - Detect
  author: biero-el-corridor
  severity: info
  description: |
    Detected Schneider Electric Modicon 340 series PLCs by identifying the BMX P34 signature via the UMAS protocol over Modbus TCP (port 502).The Modicon 340 series is part of Schneider Electric’s industrial automation product line used in Industrial Control Systems (ICS).
  metadata:
    verified: true
    shodan-query: port:502 "P34"
  tags: ics,schenider,modicon,detect,network

tcp:
  - inputs:
      - data: "000000000005002b0e0200"
        type: hex
        read: 200
        name: info
      - data: "000100000004005a0002"
        type: hex
        read: 200
        name: note

    host:
      - "{{Hostname}}"
    port: 502
    read-size: 1024

    matchers-condition: and
    matchers:
      - type: word
        part: note
        words:
          - "BMX P34"

      - type: word
        part: info
        words:
          - "Schneider Electric"
# digest: 4b0a00483046022100f303f6b5422f78165bfe13d5840ae4df9f7d81fde7a5afcbdfcf3467f7e5ba99022100ec4a67e0a26a40fa45510edf52a153a663786c1f92d1a5b99ed586467b0c8734:922c64590222798bb761d5b6d8e72950