ICS protocol coverage using Snort 3 service inspectors
Summary: Cisco Talos detailed how Snort 3 service inspectors handle ICS protocol detection, with six inspectors now covering MMS, IEC104, ENIP/CIP, S7CommPlus, DNP3 and Modbus. The inspectors normalize pipelined and fragmented messages and expose plaintext rule options, and several ship built-in rules for protocol abnormalities: 54 for IEC104, four for CIP, and three for S7CommPlus.
Why it matters: ICS protocols carry bitfields, multiple encapsulation layers, pipelining and fragmentation that let traffic evade hand-written plaintext rules, so detection coverage on OT networks depends on protocol-aware normalization rather than rule-writing effort. Talos notes its own MMS and IEC104 rule sets indicate only the presence of particular messages and are not indicative of malicious traffic on their own.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026