id: schneider-modicon-580-detect

info:
  name: Schneider Electric Modicon 580 Series PLC - Detect
  author: biero-el-corridor
  severity: info
  description: |
    Detected Schneider Electric Modicon 580 series PLCs by identifying the BME P58 signature via the UMAS protocol over Modbus TCP (port 502).The Modicon 580 series is part of Schneider Electric’s industrial automation product line used in Industrial Control Systems (ICS).
  metadata:
    verified: true
    max-request: 2
    shodan-query: port:502 "P58"
  tags: ics,schenider,modicon,detect,network

tcp:
  - inputs:
      - data: "000000000005002b0e0200"
        type: hex
        read: 200
        name: info
      - data: "000100000004005a0002"
        type: hex
        read: 200
        name: note

    host:
      - "{{Hostname}}"
    port: 502
    read-size: 1024

    matchers-condition: and
    matchers:
      - type: word
        part: note
        words:
          - "BME P58"

      - type: word
        part: info
        words:
          - "Schneider Electric"
# digest: 490a0046304402204f7fed9e38ca2059798f0b92b9dabec092fbd54cbc0039ca8d3d699f32746bea02207d48144efddcdb01345a7c78c60a2798d365a27ae91783f2a11d322d32571f03:922c64590222798bb761d5b6d8e72950