id: red-lion-enip-detect

info:
  name: Red Lion ENIP - Detect
  author: biero-el-corridor
  severity: info
  description: |
    Detects Red Lion industrial control devices by sending Ethernet/IP (ENIP) protocol requests to port 789 and identifying devices that respond with "Red Lion Controls" in their response. This template can be used to discover and fingerprint Red Lion devices on industrial networks.
  metadata:
    max-request: 2
  tags: ics,redlion,detect,network,tcp

tcp:
  - inputs:
      - data: "0004012b1b00"
        type: hex
        read: 200
        name: info
      - data: "0004012a1a00"
        type: hex
        read: 200
        name: note

    host:
      - "{{Hostname}}"
    port: 502
    read-size: 1024

    matchers:
      - type: binary
        part: info
        binary:
          - "526564204c696f6e20436f6e74726f6c73" # Red Lion Controls
# digest: 4a0a004730450220771144358de2daff84cd0c36ab3803e194baaa2aaa19d726c97d31d6c3d23ade0221008a1e53d2468c08c5386eec77c1a7bb16a27d20c6d62826e899e13bbe544075e0:922c64590222798bb761d5b6d8e72950