IEC 104 Protocol Detection Rules
Summary: Cisco Talos released Snort detection rules for IEC 104, the ICS protocol: SIDs 41053-41077 detect various TypeIDs, and SIDs 41078-41079 detect IEC 104 traffic entering or exiting the ICS network. Talos states the rules should be selectively enabled, require correctly configured $EXTERNAL_NET and $HOME_NET variables, and should not be turned on in networks without IEC 104 traffic because they will likely produce false positives on non-IEC 104 traffic.
Key Takeaway: These rules only work if someone knows which TypeIDs are actually in use on the ICS network and whether 104 traffic is supposed to cross its boundary - enable them blindly and the false positives bury the alerts that matter.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026