Siemens SIMATIC S7-1500 MFP: Hardening Linux Subsystem Exposure

---
title: Potential Linux Subsystem Access to Siemens MFP
id: a1b2c3d4-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects inbound SSH or HTTP connections to Siemens S7-1500 MFP devices, indicating access to the GNU/Linux subsystem rather than standard PLC operations.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.initial_access
  - attack.t1190
  - ics.attck
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    DestinationPort:
      - 22
      - 80
      - 443
  selection_ot_scope:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection_ports and selection_ot_scope
falsepositives:
  - Legitimate administration by authorized engineers using SSH/Web for MFP management
level: medium
---
title: Siemens S7comm Plus Non-Standard Source
id: b2c3d4e5-6789-01ab-cdef-2345678901bc
status: experimental
description: Detects connections to Siemens PLC ports (102/TCP) from sources outside known engineering workstation ranges, probing for control access.
references:
  - https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.initial_access
  - ics.attck
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 102
  filter_known_eng:
    SourceIp|cidr:
      - '192.168.10.0/24' # Example Engineering VLAN
  condition: selection and not filter_known_eng
falsepositives:
  - New engineering workstations not yet classified
level: high


**KQL (Microsoft Sentinel)**

let OT_Ip_Ranges = dynamic(["10.20.30.0/24", "192.168.50.0/24"]); // Define your OT subnets
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where DestinationPort in (22, 80, 443, 8080) // Linux Subsystem Ports
| where ipv4_is_in_range(DestinationIP, OT_Ip_Ranges)
| project Timestamp, DeviceName, InitiatingProcessAccount, SourceIP, DestinationIP, DestinationPort, RemotePort
| summarize count() by DestinationIP, SourceIP, DestinationPort
| where count_ < 10 // Filter for noise, look for low frequency scanning


**Velociraptor VQL**

-- Hunt for processes connecting to OT PLC IP ranges on Linux subsystem ports
SELECT Pid, Name, CommandLine, RemoteAddress, RemotePort, StartTime
FROM listen()
WHERE RemotePort IN (22, 80, 443)
  AND regex_replace(RemoteAddress, "^.*:", "") =~ "^(10|172|192)\." -- Catch private IPs connecting to PLCs


**Remediation Script (Bash)**

A script for OT Security Admins to run from a Linux-based administration server to check if the MFP Linux subsystem interfaces are reachable (and thus potentially exposed) from the admin network.

#!/bin/bash
# Siemens S7-1500 MFP Subsystem Check
# Verifies exposure of Linux services (SSH, HTTP) on target PLCs

TARGETS=("192.168.1.100" "192.168.1.101") # Replace with MFP IP addresses
TIMEOUT=2

echo "Scanning for Linux Subsystem Exposure on Siemens MFPs..."

for IP in "${TARGETS[@]}"; do
    echo "Checking $IP..."
    
    # Check SSH (Port 22)
    if timeout $TIMEOUT bash -c "</dev/tcp/$IP/22" 2>/dev/null; then
        echo "[ALERT] SSH Port 22 is OPEN on $IP - Linux Subsystem Exposed"
    else
        echo "[INFO] SSH Port 22 is closed or filtered on $IP"
    fi
    
    # Check HTTP (Port 80)
    if timeout $TIMEOUT bash -c "</dev/tcp/$IP/80" 2>/dev/null; then
        echo "[ALERT] HTTP Port 80 is OPEN on $IP - Linux Subsystem Exposed"
    else
        echo "[INFO] HTTP Port 80 is closed or filtered on $IP"
    fi

done