domains / families / security / monitoring-scada-modbus-traffic-anomalies

monitoring-scada-modbus-traffic-anomalies

separate

'Monitors Modbus TCP traffic on SCADA and ICS networks to detect anomalous

When to use

• Monitoring OT/ICS networks for unauthorized Modbus commands targeting PLCs, RTUs, or HMIs
• Detecting reconnaissance activity such as Modbus device enumeration (function code 43, Read Device Identification)
• Identifying unauthorized write operations (function codes 05, 06, 15, 16) to coils and holding registers that could alter physical process parameters
• Baselining normal Modbus communication patterns and alerting on deviations in function code distribution, register access ranges, or timing intervals
• Investigating suspected sabotage or insider threats manipulating SCADA process values through Modbus register writes

When not to use

• Networks without authorization from the asset owner
• Active injection or fuzzing against production SCADA systems
• Replacement for safety-instrumented systems (SIS)

Skill page

Source