id: snap7-honeypot-default-config

info:
  name: Snap7 Honeypot Default Configuration - Detect
  author: biero-el-corridor
  severity: info
  description: |
    Detected honeypot instances using default snap7 (S7comm protocol) configurations by analyzing response patterns to S7comm requests.These signatures indicate systems likely running in research or security testing environments rather than production ICS.
  reference:
    - https://github.com/sefcom/honeyplc
    - https://medium.com/@biero-llagas/simple-use-of-the-python-snap7-lib-now-with-real-honeypot-11a2979baaf0
  tags: ics,s7comm,detect,honeypot,network,network,tcp

tcp:
  - inputs:
      - data: "0300001611e00000001400c1020100c2020102c0010a"
        type: hex
      - data: "0300001902f08032010000000000080000f0000001000101e0"
        type: hex
      - data: "0300002102f080320700000000000800080001120411440100ff09000400110001"
        type: hex
      - data: "0300002102f080320700000000000800080001120411440100ff09000400110001"
        type: hex
      - data: "0300002102f080320700000000000800080001120411440100ff090004001c0001"
        type: hex

    host:
      - "{{Hostname}}"
    port: 102
    read-size: 512

    matchers:
      - type: binary
        binary:
          - "0300001611d00014000100c1020100c2020102c0010a0300001b02f080320300000000000800000000f0000001000101e00300009902f080320700000000000c007c000112081284010000000000ff09007800110000001c0004000136455337203331352d32454831342d304142302000c000040001000636455337203331352d32454831342d304142302000c0000400010007202020202020202020202020202020202020202000c0560302060081426f6f74204c6f61646572202020202020202020000041200909"
# digest: 4a0a0047304502207c88589e81ec4c027ccb291b49ea3ded8937334051d734446e0f553142650ad8022100da1ac9c6cd93566ceb76d076dd8e78be343789a1404ea7621e8a9541817884ee:922c64590222798bb761d5b6d8e72950