id: allen-bradley-plc5-detect

info:
  name: Allen-Bradley PLC-5 Series PLC - Detect
  author: biero-el-corridor
  severity: info
  description: |
    Detected Allen-Bradley (Rockwell Automation) PLC-5 series PLCs by identifying the 1771-, 1772-, and 1785- model prefixes via the EtherNet/IP CIP protocol over port 44818.
  metadata:
    shodan-query: 'port:44818 "Vendor ID: Rockwell Automation/Allen-Bradley"'
  tags: ics,allen-bradley,plc-5,detect,network,tcp

tcp:
  - inputs:
      - data: "630000000000000000000000000000000000000000000000"
        type: hex
        read: 200
        name: info

    host:
      - "{{Hostname}}"
    port: 44818
    read-size: 1024

    matchers:
      - type: binary
        part: info
        binary:
          - "313737312d" # 1771
          - "313737322d" # 1772
          - "313738352d" # 1785- https://www.ideadigitalcontent.com/files/11994/ID-SPE-1785-sg001_-en-p.pdf
        condition: or
# digest: 4b0a00483046022100870d47367d55e4116e7c4cf4ba0e34a572da01fc4018c18d26b0561c45b64aae022100aef3fcad225245a543c6664d6a03459f28732de544a5d77d71aaa21cf082cc97:922c64590222798bb761d5b6d8e72950