detecting-modbus-command-injection-attacks

Monitor TCP port 502 traffic and compare write function codes (FC5, FC6, FC15, FC16) against a baseline of authorized master IPs and register ranges. The included Python detector uses Scapy to parse MBAP headers and flags writes from non-authorized sources as CRITICAL alerts.

Use Suricata rules matching modbus_func keywords like write_single_coil and write_multiple_registers from non-authorized sources, plus rules for unit ID 0 broadcast writes and excessive write rates. The Skill provides six ready rules with classtype and threshold configurations.

Yes, the detector accepts pcap or pcapng files for offline analysis using Scapy's rdpcap function, in addition to live interface monitoring. This lets you validate detection rules against labeled captures without touching live PLC traffic.

Modbus TCP has no authentication, so attackers can spoof a legitimate master IP to make malicious writes appear authorized. Combine IP allowlisting with ARP inspection, static MAC bindings, register value bounds, and write-rate limits to close this gap.

Function code matching alone misses attacks that reuse permitted codes and registers, as FrostyGoop did. It also cannot see Modbus RTU serial traffic behind gateways if the SPAN only watches TCP/502, and legitimate SCADA writes use the same codes, requiring change-log correlation.