 |
Snort: Rule to detect Modbus device fingerprinting Tue, 21 Apr 2009 I've just published a snort rule to detect Scada Modbus Device fingerprinting tools like modscan: alert tcp any any -> any 502 (msg:"ET SCAN Modbus Scanning detected"; content:"|00 00 00 00 00 02|"; depth:6; threshold: type both, track by_src, count 100, seconds 10; classtype:bad-unknown; reference:url,code.google.com/p/modscan/; reference:url,www.rtaautomation.com/modbustcp/; sid:2009286; rev:1;) You caN find it at Emerging Threats posted at: 15:55 | path: /Scada Security | permanent link to this entry | 0 comments | |
Categories
/ (31) Jaime Blasco (feel free to get in touch) Friend's blogs: 
Lecture...
Archives
2010-Jan Tags
| | ||||||||||||||||||||||||||||||||||||||||||||||||||
 |
 |
