Rockwell Logic Implants: Defending Against Iranian APT Targeting of Exposed PLCs

---
title: Rockwell PLC CIP Exposure on Public Interface
id: 8a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
status: experimental
description: Detects inbound network connections to Rockwell EtherNet/IP ports (44818/TCP, 2222/UDP) from external non-internal IP ranges, indicating potential exposure or scanning.
references:
  - https://www.cisa.gov/news-events/alerts/2026/04/07/iranian-apt-actors-targeting-ot-devices
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.initial_access
  - attack.t1190
  - ics.scada
logsource:
  category: firewall
detection:
  selection:
    DestinationPort:
      - 44818
      - 2222
    Protocol:
      - TCP
      - UDP
  filter_internal:
    SourceIpRange:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - 'fc00::/7'
  condition: selection and not filter_internal
falsepositives:
  - Legitimate remote vendor access via VPN (if VPN IPs are not classified as internal in logs)
level: critical
---
title: Suspicious Process Spawn by Rockwell Engineering Software
id: 9b3c4d5e-6f7g-8h9i-0j1k-2l3m4n5o6p7q
status: experimental
description: Detects the execution of cmd.exe or powershell.exe spawned by Rockwell Automation engineering tools (Studio 5000, RSLogix), often indicative of exploitation or scripting logic changes.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/08
tags:
  - attack.execution
  - attack.t1059.001
  - ics.impact
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - '\Studio 5000\'
      - '\RSLogix 5000\'
      - '\FactoryTalk Services\'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection_*
falsepositives:
  - Legitimate automation scripts launched by engineers
level: medium

// Hunt for inbound connections to Rockwell CIP ports from non-corporate IPs
let PrivateIPs = datatable(IP:string) ['10.0.0.0/8', '172.16.0.0/12', '192.168.0.0/16', 'fc00::/7'];
DeviceNetworkEvents
| where DeviceName in~("Firewall", "Gateway", "OT-Sensor") // Adjust for specific device naming or use CommonSecurityLog
| extend DestinationPort = toint(RemotePort)
| where DestinationPort in (44818, 2222)
| extend IsPrivate = ipv4_is_in_range(RemoteIP, "10.0.0.0/8") or ipv4_is_in_range(RemoteIP, "172.16.0.0/12") or ipv4_is_in_range(RemoteIP, "192.168.0.0/16")
| where IsPrivate == false
| summarize count() by RemoteIP, DeviceName, DestinationPort
| order by count_ desc

-- Hunt for established network connections to Rockwell CIP ports (44818) on Windows endpoints
-- Note: This primarily detects Engineering Workstations or HMI servers exposed to the internet
SELECT
  Pid, Name, CommandLine, Exe, Username,
  RemoteAddress, RemotePort, State
FROM win_netstat()
WHERE RemotePort == 44818
   OR RemotePort == 2222

-- Supplemental: Hunt for Rockwell Engineering Software processes
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ 'Studio5000.exe'
   OR Name =~ 'RSLogix5000.exe'
   OR Name =~ 'LogixDesigner.exe'

<#
.SYNOPSIS
    Audit internal network for Rockwell PLC ports 44818 and 2222 exposure.
.DESCRIPTION
    Scans a provided IP range or subnet list for open EtherNet/IP ports to identify shadow IT or
    misconfigured devices exposed to the internal network that could be pivoted to.
#>

param (
    [string[]]$TargetSubnets = @("192.168.1.0/24"),
    [int]$Timeout = 500
)

$Ports = @(44818, 2222)
$Results = @()

Write-Host "Starting Rockwell PLC Exposure Audit..." -ForegroundColor Cyan

foreach ($Subnet in $TargetSubnets) {
    $IPRange = Get-NetIPAddress -AddressFamily IPv4 | Where-Object { $_.IPAddress -like ("*" + ($Subnet -split "/")[0].Substring(0,3) + "*") } # Crude range expansion logic for demo
    
    # In a real scenario, iterate through calculated IPs. For safety, we scan localhost/gateway as demo.
    $TestIPs = @("127.0.0.1", (Get-NetRoute | Where-Object DestinationPrefix -eq "0.0.0.0/0").NextHop)
    
    foreach ($IP in $TestIPs) {
        foreach ($Port in $Ports) {
            try {
                $TcpClient = New-Object System.Net.Sockets.TcpClient
                $Connect = $TcpClient.BeginConnect($IP, $Port, $null, $null)
                $Wait = $Connect.AsyncWaitHandle.WaitOne($Timeout, $false)
                
                if ($Wait) {
                    $TcpClient.EndConnect($Connect)
                    $Results += [PSCustomObject]@{
                        IP = $IP
                        Port = $Port
                        Status = "OPEN"
                        Timestamp = Get-Date
                    }
                    Write-Host "[ALERT] Open Rockwell Port Found: $IP : $Port" -ForegroundColor Red
                }
                $TcpClient.Close()
            } catch {
                # Port closed or filtered
            }
        }
    }
}

if ($Results) {
    $Results | Export-Csv -Path "Rockwell_Exposure_Report.csv" -NoTypeInformation
} else {
    Write-Host "No common Rockwell ports detected open on target scope." -ForegroundColor Green
}