id: allen-bradley-micrologix-detect

info:
  name: Allen-Bradley MicroLogix Series PLC - Detect
  author: biero-el-corridor
  severity: info
  description: |
    Detected Allen-Bradley (Rockwell Automation) MicroLogix series PLCs by identifying the 1761-, 1762-, 1763-, 1764-, and 1766- model prefixes via the EtherNet/IP CIP protocol over port 44818.The MicroLogix series includes compact PLCs such as the 1100, 1400, and 1500, widely used in industrial automation and control systems.
  metadata:
    shodan-query: 'port:44818 "Vendor ID: Rockwell Automation/Allen-Bradley"'
  tags: ics,allen-bradley,micrologix,detect,network,tcp

tcp:
  - inputs:
      - data: "630000000000000000000000000000000000000000000000"
        type: hex
        read: 200
        name: info

    host:
      - "{{Hostname}}"
    port: 44818
    read-size: 1024

    matchers:
      - type: binary
        part: info
        binary:
          - "313736312d" # 1761- (1761: Fixed I/O, entry-level controllers)
          - "313736322d" # 1762- (1762: Similar to 1761 but with expansion capabilities)
          - "313736332d" # 1763- (1763: MicroLogix 1100 series)
          - "313736342d" # 1764- (1764: MicroLogix 1400 series)
          - "313736362d" # 1766- (1766: MicroLogix 1500 series)
        condition: or
# digest: 4a0a00473045022100ac30377d6f24430ef11cdff474452154e2ea3b36daee632e9cd15d5f220af235022053ec39680243c3429f50129b501b3ffd67a6be3ef9edb581d75e6ac92d07c52c:922c64590222798bb761d5b6d8e72950