id: allen-bradley-compactlogix-detect

info:
  name: Allen-Bradley CompactLogix Series PLC - Detect
  author: biero-el-corridor
  severity: info
  description: |
    Detected Allen-Bradley CompactLogix series via the ENIP-CIP protocol using the -resp flag to view the PLC model.
  metadata:
    verified: true
    shodan-query: 'port:44818 "Vendor ID: Rockwell Automation/Allen-Bradley"'
  tags: ics,allen-bradley,compactlogix,detect,network,tcp

tcp:
  - inputs:
      - data: "630000000000000000000000000000000000000000000000"
        type: hex
        read: 200
        name: info

    host:
      - "{{Hostname}}"
    port: 44818
    read-size: 1024

    matchers:
      - type: binary
        part: info
        binary:
          - "313736392d" # 1769- (1769-L23: Built-in I/O || 1769-L24ER: With expansion capabilities || 1769-L30ER: Higher performance || 1769-L35ER: High-end version)
# digest: 4a0a0047304502205b58459396b420e53b77daa26ea52638e7e3260e861d1e0769855168a99cd613022100dd02a9aaccc31d45649a7127950781c4bc61c19aaced76698cdb88085e06d1bc:922c64590222798bb761d5b6d8e72950