### Install ICSNPP-S7COMM using Zeek Package Manager Source: https://github.com/cisagov/icsnpp-s7comm/blob/main/README.md Installs the ICSNPP-S7COMM plugin using the Zeek Package Manager (zkg). This is the recommended installation method for seamless integration with Zeek. After installation, the plugin can be verified by running 'zeek -N'. ```bash zkg refresh zkg install icsnpp-s7comm ``` -------------------------------- ### Manual Installation of ICSNPP-S7COMM Plugin from Source Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt Provides instructions for manually installing the ICSNPP-S7COMM plugin from its source code. This includes cloning the repository, configuring and building the plugin, testing it locally using ZEEK_PLUGIN_PATH, and finally installing it system-wide. ```bash # Clone repository git clone https://github.com/cisagov/icsnpp-s7comm.git cd icsnpp-s7comm/ # Configure and build ./configure make # Test locally with ZEEK_PLUGIN_PATH export ZEEK_PLUGIN_PATH=$PWD/build/ zeek -N | grep S7COMM # Install system-wide sudo make install unset ZEEK_PLUGIN_PATH zeek -N | grep S7COMM ``` -------------------------------- ### Install ICSNPP-S7COMM Plugin via Zeek Package Manager Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt Installs the ICSNPP-S7COMM plugin using the Zeek Package Manager (zkg). This involves refreshing the package index and then installing the package. It also includes a command to verify the installation by checking Zeek's loaded plugins. ```bash # Refresh package index and install zkg refresh zkg install icsnpp-s7comm # Verify installation zeek -N | grep S7COMM # Expected output: ICSNPP::S7COMM - S7comm, S7comm-plus and COTP analyzer (dynamic, version 1.3) ``` -------------------------------- ### Run ICSNPP-S7COMM on a Packet Capture (Manual Install) Source: https://github.com/cisagov/icsnpp-s7comm/blob/main/README.md Executes the ICSNPP-S7COMM plugin on a specific packet capture file after a manual installation. This command loads the plugin's scripts to parse the specified pcap file. ```bash zeek -Cr icsnpp-s7comm/tests/traces/s7comm_plus_example.pcap icsnpp/s7comm ``` -------------------------------- ### Run ICSNPP-S7COMM on a Packet Capture using ZKG Source: https://github.com/cisagov/icsnpp-s7comm/blob/main/README.md Executes the ICSNPP-S7COMM plugin on a specific packet capture file when installed via ZKG. This command loads the plugin's scripts to parse the specified pcap file. ```bash git clone https://github.com/cisagov/icsnpp-s7comm.git zeek -Cr icsnpp-s7comm/tests/traces/s7comm_plus_example.pcap icsnpp/s7comm ``` -------------------------------- ### Custom S7comm Alerting in Zeek Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt An example Zeek script demonstrating custom event handling for S7comm protocol. It defines an event 's7comm_header' to trigger alerts on PLC Stop commands (function code 0x29) and block downloads (function codes 0x1a, 0x1b). ```zeek @load icsnpp/s7comm event s7comm_header(c: connection, is_orig: bool, rosctr: count, pdu_reference: count, function_code: count, subfunction: count, plc_control: string, error_class: count, error_code: count) { # Alert on PLC Stop commands if (function_code == 0x29) { print fmt("ALERT: PLC Stop command from %s to %s", c$id$orig_h, c$id$resp_h); } # Alert on block downloads if (function_code == 0x1a || function_code == 0x1b) { print fmt("ALERT: Block download initiated from %s to %s", c$id$orig_h, c$id$resp_h); } } ``` -------------------------------- ### Load ICSNPP-S7COMM Plugin in Zeek Site Configuration Source: https://github.com/cisagov/icsnpp-s7comm/blob/main/README.md Demonstrates how to load the ICSNPP-S7COMM plugin by adding a directive to the Zeek site configuration file (`site/local.zeek`). This ensures the plugin is active for a running Zeek instance. ```zeek @load icsnpp/s7comm ``` -------------------------------- ### Run ICSNPP-S7COMM Plugin Tests with btest Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt Commands to execute the test suite for the ICSNPP-S7COMM Zeek plugin using the 'btest' utility. It covers running all tests, specific analyzer tests, and updating baseline test results. ```bash # Navigate to testing directory cd icsnpp-s7comm/testing # Run all tests with btest btest -c btest.cfg # Run specific analyzer tests btest -c btest.cfg analyzer/snap7.zeek btest -c btest.cfg analyzer/s7comm_plus.zeek btest -c btest.cfg analyzer/s7ident.zeek # Update baselines after intentional changes btest -U -c btest.cfg ``` -------------------------------- ### Configure ICSNPP S7comm Zeek Plugin Build Source: https://github.com/cisagov/icsnpp-s7comm/blob/main/CMakeLists.txt This CMake script configures the build process for the ICSNPP S7comm Zeek plugin. It specifies the minimum required CMake version, project name, and includes the ZeekPlugin module. It then defines the plugin's components, including C++ source files, Bro Interface Files (BIF), Packet Analyzer (PAC) files, and files to be distributed. ```cmake cmake_minimum_required(VERSION 3.15 FATAL_ERROR) project(Plugin) include(ZeekPlugin) zeek_plugin_begin(ICSNPP S7comm) zeek_plugin_cc(src/S7COMM.cc src/Plugin.cc) zeek_plugin_bif(src/events.bif) zeek_plugin_pac(src/s7comm.pac src/s7comm-analyzer.pac src/s7comm-protocol.pac) zeek_plugin_dist_files(README CHANGES COPYING VERSION) zeek_plugin_end() ``` -------------------------------- ### Configure Automatic S7comm Loading in Zeek Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt This Zeek script snippet configures the S7comm plugin to load automatically in a production deployment by adding '@load icsnpp/s7comm' to the site/local.zeek file. It also shows optional customizations for logging policy and non-standard ports. ```zeek # Add to site/local.zeek for automatic loading: @load icsnpp/s7comm # Optional: Customize logging behavior redef S7COMM::log_policy_s7comm = function(rec: S7COMM::S7COMM, id: Log::ID, filter: Log::Filter): bool { # Example: Only log PLC control operations return rec$function_name == "PLC Control" || rec$function_name == "PLC Stop"; }; # Optional: Add custom port if S7comm runs on non-standard port redef S7COMM::ports += { 1102/tcp }; ``` -------------------------------- ### COTP Protocol Logging Event Handler in Zeek Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt Demonstrates the Zeek event handler for logging COTP (Connection-Oriented Transport Protocol) packets. It shows the event signature and how the handler populates and writes COTP log items, including PDU type and connection details. ```zeek # Event signature from events.bif event cotp(c: connection, is_orig: bool, pdu: count); # The event handler in main.zeek processes COTP packets: event cotp(c: connection, is_orig: bool, pdu: count) { add c$service["cotp"]; local cotp_item: COTP; cotp_item$ts = network_time(); cotp_item$uid = c$uid; cotp_item$id = c$id; cotp_item$is_orig = is_orig; cotp_item$pdu_code = fmt("0x%02x", pdu); cotp_item$pdu_name = cotp_pdu_types[pdu]; Log::write(LOG_COTP, cotp_item); } # Sample cotp.log output: #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p is_orig source_h source_p destination_h destination_p pdu_code pdu_name 1234567890.123456 CHhAvVGS1DHFjwGM9 134.217.61.131 51212 134.217.61.211 102 T 134.217.61.131 51212 134.217.61.211 102 0x0e CR Connection Request 1234567890.234567 CHhAvVGS1DHFjwGM9 134.217.61.131 51212 134.217.61.211 102 F 134.217.61.211 102 134.217.61.131 51212 0x0d CC Connection Confirm 1234567890.345678 CHhAvVGS1DHFjwGM9 134.217.61.131 51212 134.217.61.211 102 T 134.217.61.131 51212 134.217.61.211 102 0x0f DT Data ``` -------------------------------- ### Extract ICSNPP-S7COMM Plugin from TGZ Archive Source: https://github.com/cisagov/icsnpp-s7comm/blob/main/README.md Explains how to extract the ICSNPP-S7COMM plugin from a TGZ archive into a specified Zeek plugin directory. This is useful for deploying a pre-built plugin without compiling. ```bash tar xvzf build/ICSNPP_S7comm.tgz -C $ZEEK_PLUGIN_PATH ``` -------------------------------- ### Zeek Analysis of S7comm Traffic Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt This bash command demonstrates how to run Zeek analysis on a pcap file containing S7comm traffic. It specifies the input pcap file and the Zeek script directory, generating structured log files for security analysis. ```bash # Basic analysis of a pcap file zeek -Cr /path/to/s7comm_traffic.pcap icsnpp/s7comm # Output files generated: # - cotp.log : COTP transport layer events # - s7comm.log : S7comm protocol headers # - s7comm_read_szl.log : SZL read operations ``` -------------------------------- ### S7comm-Plus Header Logging with Zeek Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt This Zeek script defines and logs S7comm-plus protocol headers, capturing version, opcode, and function code for newer Siemens PLCs. It includes mappings for opcodes and functions, aiding in the analysis of enhanced S7comm communication. ```zeek event s7comm_plus_header(c: connection, is_orig: bool, version: count, opcode: count, function_code: count); const s7comm_plus_opcodes = { [0x31] = "Request", [0x32] = "Response", [0x33] = "Notification" }; const s7comm_plus_functions = { [0x04bb] = "Explore", [0x04ca] = "Create Object", [0x04d4] = "Delete Object", [0x04f2] = "Set Variable", [0x0524] = "Get Link", [0x0542] = "Set Multi Variables", [0x054c] = "Get Multi Variables", [0x0556] = "Begin Sequence", [0x0560] = "End Sequence", [0x056b] = "Invoke", [0x0586] = "Get Variable Sub Streamed" }; # Sample s7comm_plus.log output: #fields ts uid is_orig version opcode opcode_name function_code function_name 1234567890.123456 CHhAvVGS1DHFjwGM9 T 3 0x31 Request 0x04f2 Set Variable 1234567890.234567 CHhAvVGS1DHFjwGM9 F 3 0x32 Response 0x04f2 Set Variable 1234567890.345678 CHhAvVGS1DHFjwGM9 F 3 0x33 Notification - - 1234567890.456789 CHhAvVGS1DHFjwGM9 T 3 0x31 Request 0x054c Get Multi Variables 1234567890.567890 CHhAvVGS1DHFjwGM9 F 3 0x32 Response 0x054c Get Multi Variables ``` -------------------------------- ### S7comm Upload/Download Log Structure Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt This log captures the structure of S7comm upload and download operations, detailing fields like function name, status, block length, filename, and block type. It is useful for understanding file transfer activities within S7comm communication. ```text #fields ts uid is_orig rosctr pdu_reference function_name function_status session_id blocklength filename block_type block_number destination_filesystem 1234567890.123456 CHhAvVGS1DHFjwGM9 T Job-Request 8 Start Upload - - - _0A00001P Data Block 00001 Passive 1234567890.234567 CHhAvVGS1DHFjwGM9 F ACK-Data 8 Start Upload 0x00 1234 512 _0A00001P Data Block 00001 Passive 1234567890.345678 CHhAvVGS1DHFjwGM9 T Job-Request 9 Upload - 1234 - - - - - 1234567890.456789 CHhAvVGS1DHFjwGM9 F ACK-Data 9 Upload 0x00 1234 512 - - - - 1234567890.567890 CHhAvVGS1DHFjwGM9 T Job-Request 10 End Upload - 1234 - - - - - ``` -------------------------------- ### Process S7comm Traffic with Zeek Scripts Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt This command processes a pcap file containing S7comm traffic using Zeek and custom scripts. It requires the 'icsnpp/s7comm' script and a 'local.zeek' file for custom analysis. ```bash zeek -Cr s7comm_traffic.pcap icsnpp/s7comm local.zeek ``` -------------------------------- ### S7comm Device Identification Logging with Zeek Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt This Zeek script logs device identification information from S7comm communication, including automation system name, module name, plant name, and serial number. It defines opcode mappings and an event handler to accumulate this data during a connection. ```zeek event s7comm_device_identification(c: connection, opcode: count, value: string); # Opcode mappings for device identification: # 0x0001 = automation_system_name # 0x0002 = module_name # 0x0003 = plant_name # 0x0005 = module_serial # Event handler accumulates device info during connection: event s7comm_device_identification(c: connection, opcode: count, name: string) { if (! c?$s7comm_device_info) { local s: S7COMM_KNOWN_DEVICES; c$s7comm_device_info = s; } name = rstrip(name, "\x00"); if (opcode == 0x0001) { c$s7comm_device_info$automation_system_name = name; } if (opcode == 0x0002) { c$s7comm_device_info$module_name = name; } if (opcode == 0x0003) { c$s7comm_device_info$plant_name = name; } if (opcode == 0x0005) { c$s7comm_device_info$module_serial = name; } } # Sample s7comm_known_devices.log output: #fields ts uid source_h source_p destination_h destination_p automation_system_name module_name plant_name module_serial 1234567890.123456 CHhAvVGS1DHFjwGM9 134.217.61.131 51212 134.217.61.211 102 S7-300 CPU 315-2PN/DP PlantA_Line1 S C-H5K12345 ``` -------------------------------- ### S7comm Header Logging Event Signature and Constants in Zeek Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt Defines the Zeek event signature for logging S7comm header information, including ROSCTR types, function codes, and error details. It also shows the Zeek constants mapping numerical codes to human-readable names for ROSCTR types and S7comm function codes. ```zeek # Event signature from events.bif event s7comm_header(c: connection, is_orig: bool, rosctr: count, pdu_reference: count, function_code: count, subfunction: count, plc_control: string, error_class: count, error_code: count); # ROSCTR types defined in consts.zeek: const rosctr_types = { [0x01] = "Job-Request", [0x02] = "ACK", [0x03] = "ACK-Data", [0x07] = "User-Data", }; # Function codes defined in consts.zeek: const s7comm_functions = { [0x00] = "CPU Services", [0x04] = "Read Variable", [0x05] = "Write Variable", [0x1a] = "Request Download", [0x1b] = "Download Block", [0x1c] = "Download Ended", [0x1d] = "Start Upload", [0x1e] = "Upload", [0x1f] = "End Upload", [0x28] = "PLC Control", [0x29] = "PLC Stop", [0xf0] = "Setup Communication", }; ``` -------------------------------- ### S7comm Field Mapping Pseudocode Source: https://github.com/cisagov/icsnpp-s7comm/blob/main/README.md This pseudocode illustrates the relationship between Zeek's default 'id' struct, the 'is_orig' field, and the ICSNPP-added 'source' and 'destination' fields for accurately identifying packet origins and destinations in ICS traffic. ```pseudocode if is_orig == True source_h == id.orig_h source_p == id.orig_p destination_h == id.resp_h destination_p == id.resp_p if is_orig == False source_h == id.resp_h source_p == id.resp_p destination_h == id.orig_h destination_p == id.orig_p ``` -------------------------------- ### S7comm Upload/Download Event Signature and Block Types (Zeek) Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt Defines the Zeek event signature for s7comm_upload_download and the associated block type meanings. This is used for logging and analyzing file transfer operations, crucial for detecting unauthorized modifications to PLC programs. ```zeek event s7comm_upload_download(c: connection, is_orig: bool, rosctr: count, pdu_reference: count, function_code: count, function_status: count, session_id: count, blocklength: count, filename: string, block_type: string, block_number: string, destination_filesystem: string); const s7comm_block_types = { ["08"] = "Organization Block", ["0A"] = "Data Block", ["0B"] = "System Data Block", ["0C"] = "Function", ["0D"] = "System Function", ["0E"] = "Function Block", ["0F"] = "System Function Block", }; ``` -------------------------------- ### S7comm Read SZL Event Signature and Constants (Zeek) Source: https://context7.com/cisagov/icsnpp-s7comm/llms.txt Defines the Zeek event signature for s7comm_read_szl and the associated SZL ID meanings. This helps in parsing and understanding logs related to retrieving diagnostic and identification information from Siemens PLCs. ```zeek event s7comm_read_szl(c: connection, is_orig: bool, pdu_reference: count, method: count, return_code: count, szl_id: count, szl_index: count); const s7comm_szl_id = { [0x00] = "List of all the SZL-IDs of a module", [0x11] = "Module identification", [0x12] = "CPU characteristics", [0x13] = "User memory areas", [0x14] = "System areas", [0x15] = "Block types", [0x1c] = "Component Identification", [0xa0] = "Diagnostic buffer of the CPU", }; # Sample s7comm_read_szl.log output: #fields ts uid is_orig pdu_reference method szl_id szl_id_name szl_index return_code return_code_name 1234567890.123456 CHhAvVGS1DHFjwGM9 T 1 Request 0x0011 Module identification 0x0000 - - 1234567890.234567 CHhAvVGS1DHFjwGM9 F 1 Response 0x0011 Module identification 0x0000 0xff Success 1234567890.345678 CHhAvVGS1DHFjwGM9 T 2 Request 0x001c Component Identification 0x0000 - - 1234567890.456789 CHhAvVGS1DHFjwGM9 F 2 Response 0x001c Component Identification 0x0000 0xff Success ``` === COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.