Creating new detection coverage : Using SCADA OMRON-FINS as an example
Summary: A Sourcefire VRT researcher describes building Snort detection coverage for the OMRON-FINS SCADA protocol, starting from the 2008 CitectSCADA vulnerability that prompted the effort. The work produced a Wireshark dissector patch, a unit test script generating one of every OMRON-FINS command and response, and a rule set covering memory and parameter writes, program area writes and protection clears, RUN/STOP/RESET commands, clock writes, access right acquisition, file writes and deletes, forced set/reset, memory card format, overflow attempts, and a program area protect clear brute force attempt.
What you should know: The rules target commands that write to device memory, clear program protection, and start or stop jobs - the operations that change what a controller actually does, not just what it reports. Coverage for a protocol like OMRON-FINS depends on someone first reading the manual and enumerating every command, which is the step most likely to be skipped.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026