id: allen-bradley-slc-500-detect

info:
  name: Allen-Bradley SLC-500 Series PLC - Detect
  author: biero-el-corridor
  severity: info
  description: |
    Detected Allen-Bradley (Rockwell Automation) SLC-500 series PLCs by identifying the 1746- and 1747- model prefixes via the EtherNet/IP CIP protocol over port 44818. The SLC-500 series is a legacy but still widely deployed PLC family used in industrial automation and control systems.
  metadata:
    shodan-query: 'port:44818 "Vendor ID: Rockwell Automation/Allen-Bradley"'
  tags: ics,allen-bradley,slc-500,detect,network,tcp

tcp:
  - inputs:
      - data: "630000000000000000000000000000000000000000000000"
        type: hex
        read: 200
        name: info

    host:
      - "{{Hostname}}"
    port: 44818
    read-size: 1024

    matchers:
      - type: binary
        part: info
        binary:
          - "313734362d" # 1746-
          - "313737322d" # 1747-
        condition: or
# digest: 4b0a00483046022100b1fadbe05494db289aeae01118b8ce4f00c906280191bcbe61b16da12a39d0ad0221008d3b8c06174e64ab0301e0ff0167a65c181a48652fef846975d48803cbbce3be:922c64590222798bb761d5b6d8e72950