id: allen-bradley-guardplc-detect

info:
  name: Allen-Bradley GuardPLC Series PLC - Detect
  author: biero-el-corridor
  severity: info
  description: |
    Detected Allen-Bradley (Rockwell Automation) GuardPLC series PLCs by identifying 1753-, 1754-, and 1755- model prefixes via the EtherNet/IP CIP protocol over port 44818. GuardPLC is a safety-rated PLC family designed for safety-critical industrial automation and SIS applications.
  metadata:
    shodan-query: 'port:44818 "Vendor ID: Rockwell Automation/Allen-Bradley"'
  tags: ics,allen-bradley,guardplc,detect,network,tcp

tcp:
  - inputs:
      - data: "630000000000000000000000000000000000000000000000"
        type: hex
        read: 200
        name: info

    host:
      - "{{Hostname}}"
    port: 44818
    read-size: 1024

    matchers-condition: or
    matchers:
      - type: binary
        part: info
        binary:
          - "313735332d" # 1753

      - type: binary
        part: info
        binary:
          - "313735342d" # 1754

      - type: binary
        part: info
        binary:
          - "313735352d" # 1755
# digest: 4b0a004830460221009e93039b52b35dd8fcd9f8a02d3151f158c1b56bc022581370edf5c3b857cf65022100f8b179d16bab2f9d60f9e1eccacee9e9fe3dac72fd4c1cb8547bdf514793f838:922c64590222798bb761d5b6d8e72950