Hunt window: 12 months (90-day minimum) | Status: Behavioral
Two reports published days apart in August 2026 describe attacks that, read together, represent a single operational pattern rather than two unrelated incidents.
The first is the reported sabotage campaign against commercial refrigeration systems, in which internet-exposed Danfoss AK-SM 800A and AK-SC355 controllers - and platform parallels such as Copeland/Dixell XWEB systems - were forced into continuous defrost and heating cycles, driving cabinet temperatures to 50°C–80°C. The result was food spoilage at scale, equipment fires, and secondary water damage from activated sprinklers across hundreds of retail locations in Europe and beyond. The entry vector was not sophisticated: the controllers were simply reachable from the internet, and Claroty Team82 had already documented three vulnerabilities (CVE-2025-41450, -41451, -41452) that make an exposed management interface an administrative compromise waiting to happen.
The second is the August 19, 2026 joint advisory from NSA, CISA, FBI, DOE and EPA (AA26-231A) on AI-assisted exploitation of Siemens S7 Series PLCs. That advisory names no CVE, no actor, and no indicators. What it describes is capability development: threat actors querying third-party scan indexes rather than scanning themselves (T1596.005), generating working S7comm exploitation scripts with AI assistance, building tooling on the legitimate snap7 library and masquerading it as OT monitoring software (T0849), and gaining access to controllers whose authentication is unconfigured or default. The agencies assess the activity as persistent reconnaissance and pre-positioning — reads today, writes tomorrow.
Why these belong in one hunt: the cold-chain sabotage demonstrates what the S7 campaign is preparing for, on a different protocol. Both attacks start at the same place - a controller that the internet can see and that nobody authenticated properly. The refrigeration incident is the proof of impact; the S7 advisory is the warning that the same access path is being walked against process-control hardware with far higher consequences.
The uncomfortable finding is not the malware. It is the exposure. Every hypothesis in this plan ultimately reduces to two questions: can the internet see our controllers? and do we have an authorization record for this session? A hunt that waits for a signature from either report will find nothing, because neither report publishes one.
Target Platforms and Attack Surface
Platform Role Relevant Finding
Danfoss AK-SM 800A Centralized refrigeration system manager with embedded web UI CVE-2025-41450, -41451, -41452; thousands exposed on Shodan/Censys showing the StoreView banner
Danfoss AK-SC355 series Legacy cold-chain controller Affected in the same campaign; patch parity with R4.3.1
Copeland/Dixell XWEB Platform parallel in refrigeration/BMS Named in the campaign reporting; apply the same exposure logic
Siemens S7-200/300/400/1200/1500 PLCs, incl. F-series safety AA26-231A: scan-index targeting, snap7 tooling, default/unconfigured auth
Engineering workstations, jump hosts, historians Level 3/3.5 paths to TCP 102 The credential and tooling staging ground
Integrator / MSP address space Third-party remote access Advisory AA26-231A: asset owners frequently unaware their systems are exposed
The Danfoss Vulnerability Chain
· CVE-2025-41450 - Code-of-the-Day authentication bypass. A hidden, vendor-support-oriented mechanism generates a daily password from the device's current date and time. Reproduce the algorithm, reproduce the credential. Successful exploitation yields a fully authenticated administrative session without knowing the administrator password.
· CVE-2025-41451 - SMTP configuration command injection → RCE. The email authentication password field is formatted into an OS shell command without sanitization, reaching the underlying operating system as the web application's privilege level.
· CVE-2025-41452 -Authenticated Nginx headers.conf injection. Arbitrary routing directives can be implanted into the internet-facing web server, manipulating client traffic and — through an unhandled exception in sm_app — producing a repeatable denial of service against the management interface.
The attack mechanics observed in the campaign map cleanly onto this chain: scan for exposed StoreView interfaces → bypass authentication (code-of-the-day, default admin, or date-derived logic) → modify internal schedules and parameter sets → lock the plant into defrost/heating until the food is ruined.
The Siemens Overlap
AA26-231A describes a different protocol and a different objective, but the same access philosophy. Controllers reachable on TCP 102 with authentication unconfigured or minimally configured are entered without exploitation at all. Once inside, the actor enumerates the CPU (BlockList 0x2F, GetBlockInfo 0x31, GetDiagData 0x32), reads data blocks to understand the process (T0893), and retains access. The advisory's assessment is explicit: reads are preparation for writes.
The snap7/python-snap7 tooling is the connective tissue that matters for detection. It is a legitimate open-source library. The traffic it produces is well-formed S7comm. The scripts are AI-generated and named to look like monitoring software. No single observable discriminates it — the durable discriminator is context: which host, whether that host is an approved engineering workstation, and whether an approval record exists.
Hunt Hypotheses and Procedures
Scoping note on protocol coverage. TCP 102 carries both S7comm and IEC 61850 MMS, distinguished by the protocol-ID byte in the COTP payload (0x32 classic S7comm, 0x72 S7CommPlus, neither for MMS). A port-only query conflates them at sites running both. On S7-1200/1500 programmed via TIA Portal, S7CommPlus body contents are session-keyed and semantically opaque on modern firmware — treat 0x72 volume to a CPU as a programming-session indicator and fall back to connection-level evidence. Stating this up front prevents a clean negative from being read as absence of activity.
Out of scope: any active interrogation of a controller. No port scanning, no S7comm probing, no COTP connection requests, no authentication attempts, no active-query module pointed at an S7 or Danfoss device. Active queries carry genuine process risk — on a refrigeration controller mid-defrost, that risk is measured in inventory. The external-exposure leg reads third-party scan indices only and never touches target infrastructure.
Hypothesis 1 — Internet Exposure (Execute FIRST)
Statement: An external actor can identify an internet-exposed Danfoss or Siemens controller belonging to the organization through a third-party scan index, observable as exposed services in those indices.
MITRE ATT&CK: T1596.005 (Search Open Technical Databases: Scan Databases) | T1133 (External Remote Services) | ICS T0883 (Internet Accessible Device) | ICS T0846 (Remote System Discovery)
This is the advisory's own first technique. The actors read the same index the defender reads. Execute this hypothesis first — its output scopes everything below.
Collection — Danfoss surface (passive only):`
http.title:"StoreView"
http.html:"Danfoss" http.title:"AK-SM"
product:"Danfoss" port:80,443
ssl.cert.subject.CN:"<your_domain>" port:443
net:<your_public_CIDR> http.title:"StoreView"
org:"<Your Org Name>"
```
Collection — Siemens surface (passive only):
```
port:102 "Siemens"
product:"Siemens S7" port:102
port:102 net:<your_public_CIDR>
port:102 asn:AS<your_ASN>
ssl.cert.subject.CN:"<your_domain>"
```
Censys CenQL — author the nested host.services.* form so criteria hold on the same service object; never the deprecated legacy CSL form:
```
host.services: (port = "102" and software.vendor: "Siemens")
host.services: (port = 80 or port = 443) and host.services.software.product: "StoreView"
host.services.port = "102" and (host.autonomous_system.asn = <your_ASN> or host.ip: "<your_public_CIDR>")
```
Netlas — tie-breaker only, when Shodan and Censys disagree.
Analysis requirements:
1. Attribute every hit with at least two independent ownership signals - PTR, ASN, certificate CN/SAN, WHOIS/RDAP, your cloud and public-IP inventory. Shared hosting, carrier NAT and integrator-owned space break attribution in both directions. An unattributable hit is inconclusive, not negative.
2. Version-triage each Danfoss banner against R4.3.1. Anything below R4.3.1 is presumptively vulnerable to all three CVEs. For Siemens, capture 6ES7 order numbers from S7 banners to pin the exact CPU variant.
3. Corroborate in at least two engines before escalating. Absence from an index is evidence only that the index did not observe the host.
4. Historical pivot. Because target selection is performed by reading a scan index, continuous exposure means the asset has been on a published target list for the entire period. Establish how far back the exposure extends and treat it as presumptively enumerated.
5. Cross-reference the CISA KEV catalog. A KEV match on the controller or a co-resident service converts exposure into presumptive initial-access risk. Rank by ransomware ratio, not entry count.
6. Pivot hard. Every confirmed-owned exposed controller becomes a priority target hunted exhaustively under Hypotheses 2–4, with full conversation history reviewed rather than sampled.
Integrator-owned space deserves specific attention. A refrigeration controller exposed on a service provider's address range is still your controller, and the advisory identifies the integrator relationship as the reason asset owners are frequently unaware of their exposure. Where the public-IP inventory is incomplete, say so in the report rather than implying coverage.
Favicon-hash pivoting is available for stripped banners, but derive the hash passively from an index-computed value on an instance you own — never by fetching /favicon.ico from a target, and never by copying a hash from a third-party write-up, which silently hunts an unrelated population. API keys referenced by environment variable only (SHODAN_API_KEY, CENSYS_API_SECRET, NETLAS_API_KEY); a missing key is non-blocking — record the coverage gap.
Hypothesis 2 - Internal Reconnaissance Against Controllers
Statement: An actor has conducted reconnaissance against Danfoss or Siemens controllers from inside the environment, observable as sequential connection attempts across multiple addresses, programming-device role COTP connection requests, S7comm enumeration functions, or HTTP requests to .cgi endpoints (xml.cgi?action=getauth, load_nginx_headers) from hosts that are not sanctioned engineering workstations.
MITRE ATT&CK: ICS T0846 (Remote System Discovery) | ICS T0893 (Data from Local System) | T1694 (Insecure Credentials) | T1046 (Network Service Discovery)
Falcon LogScale (CQL) — baseline port 102 conversation map. Everything outside the sanctioned set is the hunt:
```
#event_simpleName = NetworkConnectIP4
| RemotePort = 102
| groupBy([aid, ComputerName, LocalAddressIP4, RemoteAddressIP4], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
CQL — sequential scanning. A legitimate engineering workstation talks to a small, stable set of CPUs; a scanner talks to many:
```
#event_simpleName = NetworkConnectIP4
| RemotePort = 102
| groupBy([aid, ComputerName], function=count(RemoteAddressIP4, distinct=true, as=UniqueTargets), limit=max)
| UniqueTargets > 5
| sort(UniqueTargets, order=desc, limit=max)
```
CQL — process attribution for port 102. NetworkConnectIP4 carries no ImageFileName; the reverse-direction join keeps the subquery under the row cap. Run at 90d or longer — long-running SCADA and historian daemons may predate a shorter window:
```
#event_simpleName = ProcessRollup2
| join({
#event_simpleName = NetworkConnectIP4
| RemotePort = 102
},
field=[aid, TargetProcessId], key=[aid, ContextProcessId], mode=inner)
| groupBy([ComputerName, UserName, ImageFileName, CommandLine], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
CQL — hosts consulting the same scan indices the actors use:
```
#event_simpleName = DnsRequest
| DomainName = /(censys|zoomeye|shodan)/i
| join({#event_simpleName = /ProcessRollup2/},
field=[aid, ContextProcessId], key=[aid, TargetProcessId], mode=left,
include=[ImageFileName, CommandLine, UserName])
| groupBy([ComputerName, DomainName, ImageFileName, UserName], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
Packet capture — full payload, non-negotiable. COTP TSAPs and S7 function codes live inside the payload; a truncated capture cannot decode them. The -G rotation requires a strftime format in the -w filename or each rotation overwrites the last; -C counts in units of 1,000,000 bytes:
```
tcpdump -i eth1 -nn -s 0 -G 3600 -C 500 -w /captures/s7_%Y%m%d_%H%M%S.pcap 'tcp port 102'
tcpdump -i eth1 -nn -s 0 -w /captures/s7_cotp_cr.pcap 'tcp port 102 and tcp[((tcp[12] & 0xf0) >> 2) + 5] = 0xe0'
```
Danfoss-specific collection. The web interface is the realistic entry point, so hunt it at the HTTP layer where S7 hunting happens at the protocol layer. Pull proxy, reverse-proxy and web server logs for every path carrying the controller management interface and query for the endpoint patterns from the Claroty research:
· xml.cgi with action=getauth — the authentication handler. Requests containing the two hidden redacted attributes that divert to check_code_of_day are the bypass in progress.
· load_nginx_headers — the CVE-2025-41452 file-upload endpoint. Any invocation outside a documented maintenance window is a finding.
· SMTP configuration updates touching the email authentication password field - the CVE-2025-41451 injection point.
Windows Event IDs on engineering workstations, jump hosts, and any Level 3 host with a route to port 102: 4688 (process creation with command line), 4104 (PowerShell script blocks), 5156 (WFP permitted connection - the host-side record of every outbound session), 5158 (WFP bind to local port — listeners and tunnels), 7045 (new service), 4624/4625 (logon attribution).
PowerShell - rarity ranking of port 102 talkers from the host firewall record:
```powershell
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=5156; StartTime=(Get-Date).AddDays(-90)} |
ForEach-Object { $x=[xml]$_.ToXml(); [pscustomobject]@{
Time=$_.TimeCreated; Host=$_.MachineName
App=$x.Event.EventData.Data[1].'#text'
DestIP=$x.Event.EventData.Data[5].'#text'
DestPort=$x.Event.EventData.Data[6].'#text' } } |
Where-Object { $_.DestPort -eq '102' } |
Export-Csv -NoTypeInformation C:\hunt\s7_port102_5156.csv
```
OT platform collection - the conversation record, not the endpoint list:
· Claroty xDome - Network > Communication > Communication Analysis. Leave Side A empty; Side B = Manufacturer "Siemens AG" or "Danfoss" (or the network carrying the controllers); Communication = Port 102 (and HTTP/HTTPS for Danfoss); Time Frame = Past Quarter. Use Client/Server rather than Direction to identify the true initiator, since Direction matches bidirectional flows. Scope by Network or VLAN rather than Category, because category-scoped clauses miss misclassified assets. Reconcile exported session and byte counts against an independent source — xDome under-reports both silently.
· Claroty CTD - retains continuous full PCAP that xDome does not. Pull the retrospective capture for every segment carrying port 102 and the Danfoss management VLANs across the full hunt window, and export through the CTD-only /v1/events/<id>/pcap surface for offline decoding. Do not treat CTD and xDome results as interchangeable.
· Nozomi Guardian - N2QL against the links table, which is where traffic lives (nodes returns endpoints, not conversations). Bound every query, because head with no argument silently returns 10 rows; use the $ prefix for field-to-field comparison or the query returns a clean-looking nothing:
```
links | where protocol == "s7" | join nodes to ip | join nodes from ip | head 1000
links | where time >= days_ago(90) | where from_zone != to_zone | head 1000
nodes | where vendor == "Siemens" and type == "PLC" | head 1000
nodes | where vendor == "Danfoss" | head 1000
```
· Dragos Platform - Communications Hub, source zone = Level 3/3.5, destination zone = Level 2/1, protocol filter S7comm, 90-day window. Pivot every cross-Purdue session to its asset record and event PCAP. Query the Industrial Protocols QFD for S7 function-code activity outside maintenance windows, and check the Knowledge Pack version before concluding an absent detection is a capability gap rather than a stale pack.
· Armis Centrix - ASQ on ipConnections; omit the boundary literal on first pass and set the time window in the UI picker rather than the query body:
```
in:ipConnections serverPort:102
in:ipConnections serverPort:102 endpointA:(networkLocation:"External")
in:activity type:"Port Scan Detected"
```
· Forescout eyeInspect — filter-driven, no analyst query language; export asset, alert and vulnerability data through the REST API or forward by syslog/CEF and hunt in the SIEM (the OT Network Security Monitoring App for Splunk with its CIM-mapped OT Asset Data Model is the canonical pattern). Leave ICS Patrol active queries disabled for S7 and Danfoss devices for the duration.
· Tenable One OT Exposure — Inventory > All Assets is both the view and the export point; filter to Siemens and Danfoss assets. Events carries policy violations including PLC Start/Stop and Project Upload — the platform's native expression of Hypothesis 4. All programmatic access is GraphQL at /graphql; OT Security has no REST /api/v1/ endpoints and pyTenable is the supported wrapper. Do not enable active queries against controllers during this hunt.
Analysis — rarity and temporal anomaly. A source-destination pair seen once is the shape of reconnaissance; frequent pairs are the operational baseline. The advisory calls out off-hours S7comm and connection patterns consistent with automated scripting rather than human operators:
```
#event_simpleName = NetworkConnectIP4
| RemotePort = 102
| formatTime(format="%H", as=HourOfDay)
| in(HourOfDay, values=["00","01","02","03","04","05","22","23"])
| groupBy([ComputerName, RemoteAddressIP4, HourOfDay], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
Wireshark — the S7comm semantic layer. These decode what connection-level queries can only count, and are the only way to separate a read from a write:
```
s7comm.param.func == 0x2f # BlockList — enumeration
s7comm.param.func == 0x31 # GetBlockInfo
s7comm.param.func == 0x32 # GetDiagData
cotp.dst-tsap
s7comm-plus
```
The destination TSAP in a COTP connection request decodes to the rack and slot of the addressed CPU; the source TSAP carries a role hint — 0x01 programming device, 0x02 operator panel, 0x10 HMI. A client presenting a programming-device role TSAP that is not the sanctioned engineering workstation is a finding on its own, regardless of what functions followed:
```
tshark -r /captures/s7_20260819_000000.pcap -Y 'cotp.type == 0x0e' -T fields -e ip.src -e ip.dst -e cotp.src-tsap -e cotp.dst-tsap
```
SNMP polling. Poll the switch port facing each controller and diff at 60-second intervals across the window. Above 1 Gbps the 32-bit counters wrap — use 64-bit high-capacity counters. AA26-231A calls for removing or changing default community strings: treat any device still answering a default community as a finding in its own right, and any -v1/-v2c access to an OT asset likewise, since those transit essentially in cleartext (RFC 3410 recommends v3 authPriv). Provision credentials via snmp.conf or createUser rather than inline, which leaves passphrases visible in the process table.
Collect trap logs and flag coldStart (1.3.6.1.6.3.1.1.5.1) and warmStart (.2) — these correspond directly to the PLCColdStart/PLCHotStart operations hunted under Hypothesis 4 — plus linkDown/linkUp (.3/.4) for port flaps and authenticationFailure (.5) for unauthorized access attempts.
Hypothesis 3 — AI-Generated snap7 Tooling, Masqueraded as OT Monitoring Software
Statement: An actor has deployed AI-generated tooling built on snap7/python-snap7 onto a host in the environment, masqueraded as legitimate OT monitoring software, observable as Python or compiled processes importing snap7 and speaking S7comm from hosts that are not approved engineering workstations.
MITRE ATT&CK: ICS T0834 (Native API) | ICS T0849 (Masquerading) | T1587.004 (Develop Capabilities: Exploits) | T1588.007 (Obtain Capabilities: Artificial Intelligence)
This is the hardest hypothesis to run cleanly, and it is worth being explicit about why. snap7 and python-snap7 are legitimate, widely used libraries. The traffic is well-formed S7comm, indistinguishable from ordinary engineering activity. The tools are named to look like monitoring software. Neither the library, the protocol, nor the process name is a reliable discriminator alone. The only durable discriminator is context: which host, whether that host is an approved engineering workstation, and whether an approval record exists. Build the approved-workstation inventory first and negate it -never allowlist by hostname pattern inside the query itself.
CQL — direct library references:
```
#event_simpleName = ProcessRollup2
| CommandLine = /snap7/i
| groupBy([ComputerName, UserName, ImageFileName, CommandLine], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
CQL — library loaded as a module. Confirm the ModuleLoad event name against the tenant's event catalog before treating a zero as a negative:
```
#event_simpleName = ModuleLoad
| ImageFileName = /snap7/i
| groupBy([ComputerName, ImageFileName], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
CQL — Python processes that actually spoke to a controller. Far more selective than either signal alone:
```
#event_simpleName = ProcessRollup2
| ImageFileName = /(python|pythonw)\.exe$/i
| join({
#event_simpleName = NetworkConnectIP4
| RemotePort = 102
},
field=[aid, TargetProcessId], key=[aid, ContextProcessId], mode=inner)
| groupBy([ComputerName, UserName, CommandLine], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
CQL — the masquerading signal directly. Processes named like monitoring software that speak S7comm. Review every result by hand — the point is not that the name is suspicious but that the combination warrants attribution to a known product:
```
#event_simpleName = ProcessRollup2
| CommandLine = /(monitor|watchdog|telemetry|collector|agent)/i
| join({
#event_simpleName = NetworkConnectIP4
| RemotePort = 102
},
field=[aid, TargetProcessId], key=[aid, ContextProcessId], mode=inner)
| groupBy([ComputerName, UserName, ImageFileName, CommandLine], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
CQL — tooling arriving on disk, with hashes for pivoting:
```
in(field=#event_simpleName, values=["NewScriptWritten","PeFileWritten","NewExecutableWritten"])
| TargetFileName = /snap7/i
| groupBy([ComputerName, TargetFileName, SHA256HashData], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
CQL — the legitimate Siemens engineering population, which defines the baseline:
```
#event_simpleName = ProcessRollup2
| ImageFileName = /(siemens\.automation|s7tgtopx|plcsim|step7|tiaportal)/i
| groupBy([ComputerName, UserName, ImageFileName, CommandLine], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
Windows Event IDs: 4688, 4104, 7045, 4697 (service installed, where audit policy provides it).
```powershell
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045; StartTime=(Get-Date).AddDays(-365)} |
Where-Object { $_.Message -match 'monitor|telemetry|collector|agent|s7|snap7' } |
Select-Object TimeCreated, MachineName, Message |
Export-Csv -NoTypeInformation C:\hunt\masq_services_7045.csv
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104; StartTime=(Get-Date).AddDays(-90)} |
Where-Object { $_.Message -match 'snap7|102|TcpClient|Socket' } |
Select-Object TimeCreated, MachineName, Message |
Export-Csv -NoTypeInformation C:\hunt\s7_scriptblocks_4104.csv
```
OT platform collection:
· Claroty xDome - Applications filter chip on the Devices surface enumerates installed software on engineering workstations, requiring the Edge or Endpoint Sensor; where only network visibility exists, fall back to Device Type "Industrial Workstation" + Manufacturer "Siemens AG" + OS Category "Windows" to bound the population.
· Dragos - the optional Active Collection agent adds software/module inventory to the Assets record; without it, Dragos sees the S7comm traffic but not the library. Register a validated pattern as a custom analytic through the analytic manager so it becomes standing detection content.
· Nozomi Guardian - the Arc host agent covers the OT-locked Windows/Linux workstations an IT EDR cannot reach, collecting process execution with image path, command line, parent and hashes, plus USB and file events. On hosts where the OEM forbids third-party agents, network-only visibility is the ceiling - record it as a coverage gap.
· Tenable One OT Exposure - the asset record carries installed-software and module data where credentialed collection is configured. Join to the port 102 talker list on asset ID rather than IP address, since addresses churn in OT.
· Armis - no host-agent view of loaded libraries; scope the device population and correlate against Falcon/Arc endpoint evidence.
YARA filesystem sweep - engineering workstations, jump hosts, Level 3 hosts with a route to port 102:
```
yara -r /opt/hunt/rules/s7_hunt.yar /home/ /opt/ /tmp/ /var/tmp/ >> /opt/hunt/hits_tooling.txt
yara -r C:\hunt\rules\s7_hunt.yar C:\Users\ C:\ProgramData\ C:\Windows\Temp\ >> C:\hunt\hits_tooling.txt
```
YARA memory scan. Classic YARA 4.5 takes the PID as a positional argument — there is no -p flag for process scanning, and YARA-X cannot scan process memory at all:
```bash
for p in $(pgrep -f 'python|s7|snap7'); do yara /opt/hunt/rules/s7_hunt.yar $p >> /opt/hunt/mem_hits.txt; done
```
```powershell
Get-Process | Where-Object { $_.ProcessName -match 'python|s7|monitor' } | ForEach-Object { & yara.exe C:\hunt\rules\s7_hunt.yar $_.Id >> C:\hunt\mem_hits.txt }
CrowdStrike Falcon RTR executes these scans on remote hosts without an on-site analyst, and a validated pattern can be promoted to a Custom IOA so the finding becomes standing detection content.
Analysis : rarity of the process population that touches port 102. A single-occurrence image name in this list deserves individual attribution:
#event_simpleName = ProcessRollup2
| join({
#event_simpleName = NetworkConnectIP4
| RemotePort = 102
},
field=[aid, TargetProcessId], key=[aid, ContextProcessId], mode=inner)
| groupBy([ImageFileName], function=count(as=cnt), limit=max)
| sort(cnt, order=asc, limit=max)
```
Wireshark — distinguish tooling from genuine engineering software by session construction. Legitimate TIA Portal sessions against S7-1200/1500 use S7CommPlus and negotiate a session key; snap7 speaks classic S7comm. A host speaking classic S7comm to an S7-1500 that the site otherwise programs exclusively through TIA Portal is a strong signal — it indicates a client that is not the engineering software:
```
s7comm and not s7comm-plus
s7comm.param.setup.pdu_length
cotp.src-tsap
```
Hypothesis 4 Write, Program-Transfer, or CPU-State Operations (and Refrigeration Parameter Tampering)
Statement: An actor has issued write, program-transfer, CPU-state, or refrigeration-schedule/parameter operations against a controller, observable as S7comm function codes outside the read set, or Danfoss configuration changes altering defrost/heating schedules, arriving from an unsanctioned source or outside an approved change window.
MITRE ATT&CK: ICS T0821 (Modify Controller Tasking) | T0836 (Modify Parameter) | T0843 (Program Download) | T0845 (Program Upload) | T0858 (Change Operating Mode) | T0816 (Device Restart/Shutdown) | T0813 (Denial of Control) | T0855 (Unauthorized Command Message)
Falcon and Datadog cannot see S7 function codes - they see that a connection occurred, not what it carried. This hypothesis runs primarily on packet capture and the OT platforms, with endpoint telemetry supplying attribution for whichever host the network evidence implicates.
The controlling S7comm function codes:
Code Function Significance
0x05 WriteVar Parameter/data write — T0836
0x1A / 0x1B / 0x1C RequestDownload / DownloadBlock / DownloadEnded Program download — T0843
0x1D / 0x1E / 0x1F StartUpload / UploadBlock / EndUpload Program upload — T0845
0x28 PIService —
0x29 PLCStop T0813 Denial of Control
0x2B / 0x2C PLCHotStart / PLCColdStart T0816
The read set is the baseline; everything else warrants a change-record correlation. In the UserData family, watch the Security and CpuPassword exchanges, which precede authentication bypass or password attacks, and SetClock, which alters the CPU clock and can defeat time-based logic or obscure a timeline.
Packet capture - full payload mandatory, because the function code sits inside the S7 parameter block:
```
tcpdump -i eth1 -nn -s 0 -G 1800 -C 500 -w /captures/s7_full_%Y%m%d_%H%M%S.pcap 'tcp port 102'
tcpdump -i eth1 -nn -s 0 -w /captures/s7_job.pcap 'tcp port 102 and tcp[((tcp[12] & 0xf0) >> 2) + 7] = 0x32'
```
Wireshark - the write, transfer and CPU-state codes this hunt exists to find:
```
s7comm.param.func == 0x05
s7comm.param.func == 0x1a or 0x1b or 0x1c or 0x1d or 0x1e or 0x1f
s7comm.param.func == 0x28 or 0x29 or 0x2b or 0x2c
```
Pair every request to its acknowledgement by PDU reference. A job that was issued is an attempt; a job whose AckData returns error class 0x00 is a completed operation, and the severity is materially different. An error class of 0x87 indicates access or protection denial - itself evidence of authentication probing against a controller:
```
tshark -r /captures/s7_full_20260819_000000.pcap -Y 's7comm.param.func in {0x05 0x1a 0x1b 0x1c 0x1d 0x1e 0x1f 0x28 0x29 0x2b 0x2c}' -T fields -e frame.time -e ip.src -e ip.dst -e s7comm.param.func -e s7comm.header.rosctr
tshark -r /captures/s7_full_20260819_000000.pcap -Y 's7comm.header.rosctr == 3' -T fields -e frame.time -e ip.src -e ip.dst -e s7comm.param.func -e s7comm.header.errclass -e s7comm.header.errcod
```
Carve the block transfer. DownloadBlock/UploadBlock data frames carry OB, FC, FB, DB and SDB bytes; RequestDownload/StartUpload parameters name the target block by type and number. Reassemble by TCP stream and compare against the gold-copy project. A download from anywhere other than the approved engineering workstation is potential logic injection and should be treated as an incident until a change record proves otherwise:
```
tshark -r /captures/s7_full_20260819_000000.pcap -Y 's7comm.param.func in {0x1b 0x1e}' -T fields -e tcp.stream | sort -u
tshark -r /captures/s7_full_20260819_000000.pcap -q -z follow,tcp,raw,0
```
Danfoss-specific write collection. The sabotage was schedule manipulation, not firmware modification. Hunt it as change records, not packets:
· Configuration diffs of defrost and heating schedules, temperature setpoints, and alarm thresholds across the hunt window. A scheduled defrost that becomes continuous, or a setpoint driven to maximum, is the effect signature observed in the campaign.
· Audit trails and change logs for the controller management interface — who changed what, from where, and against which work order.
· Any temperature excursion alarm correlated in time with a configuration change event. That correlation is the operational impact, and it changes both escalation and regulatory reporting obligations.
OT platform collection:
· Claroty xDome — Alerts > Alert Category = "OT Activity Alert" (the category covering controller operations); review the MITRE ATT&CK ICS column for T0843, T0845, T0858, T0813. All Alerts offers no time-frame selector — sort by ALERT UPDATED descending or use the API detected_time filter for a hard window; the category chip counts are lifetime rather than windowed.
· Dragos — Notifications filtered to ATT&CK-ICS Execution and Impair Process Control; every notification ships an event-based PCAP of the triggering conversation, the fastest route to the function code. Open a Case on any confirmed write or program transfer, attach the event PCAP and the Industrial Protocols QFD extract, and follow the attached playbook.
· Nozomi — hard-codes known-bad OT patterns including S7 PDU 0x1A/0x1B download-block operations from unexpected sources, and its process-variable baselining surfaces the downstream effect of a write even where the write was missed:
```
alerts | where mitre_attack ~= "T0843" | sort record_created_at asc | head 500
alerts | where time >= days_ago(90) | where risk > 7 | head 1000
variables | where last_change > days_ago(1) | head 500
```
· Tenable One OT Exposure — the strongest contribution to this hypothesis. Configuration-change and code-snapshot tracking diffs ladder logic, function blocks, tag tables and diagnostic buffers between snapshots, and it catches changes made locally by someone plugged into the front of the controller that never appear on the network at all. Pull snapshot history for every S7 and Danfoss controller and diff against the known-good baseline.
· Forescout eyeInspect — Industrial Threat Library covers S7 control operations; the LAN Communications Profile baseline flags a first-seen conversation pair. Export both and diff across the window.
· Armis — no S7 function-code decode; correlate its ipConnections export against packet findings by source address and timestamp.
Analysis — attribute the implicated source to a host and user, joining from the process side so the subquery stays small:
```
#event_simpleName = ProcessRollup2
| join({
#event_simpleName = NetworkConnectIP4
| RemotePort = 102
},
field=[aid, TargetProcessId], key=[aid, ContextProcessId], mode=inner)
| groupBy([ComputerName, UserName, ImageFileName, CommandLine], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
CQL — external-sourced logons, which would place the operator outside the environment entirely:
```
#event_simpleName = UserLogon
| in(LogonType, values=[3, 10])
| RemoteAddressIP4 = *
| !cidr(RemoteAddressIP4, subnet=["10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","127.0.0.0/8","169.254.0.0/16"])
| groupBy([ComputerName, UserName, LogonType, RemoteAddressIP4], function=count(as=cnt), limit=max)
| sort(cnt, order=desc, limit=max)
```
OT process correlation — mandatory for every confirmed write. Pull the historian trend and SCADA alarm record for a window bracketing the event. A parameter write followed by a process excursion, or a cold start followed by an alarm flood, converts a network observation into a demonstrated operational impact. For refrigeration, the excursion is the impact — correlate against temperature alarms and defrost state. Where an S7-1500F safety controller is involved, engage process safety engineering immediately rather than completing the technical analysis first.
Threat Actor Profile
Neither source attributes activity to a named group, and this plan does not speculate beyond what they state.
The S7 advisory's assessed intent is persistent reconnaissance in targeted sectors and facilities, conducted to develop capability and prepare to cause operational effects against critical infrastructure. Read access is being used to understand target environments so future write operations can be positioned. That assessment is what drives the hunt's priorities: read-only findings must be escalated with the same seriousness as writes, because the agencies characterize the reads as preparation.
The state-aligned OT-focused actor class fits most closely. Sophistication is high in tradecraft and patience even where individual techniques are simple; dwell is measured in months; the objective is pre-positioning, not immediate disruption. The access path is precisely as described: locate exposed controllers through a scan index, connect where authentication is absent or default, enumerate the CPU and its blocks, read data blocks to understand the process, retain access. Characteristic TTPs: T1596.005, T1694, T0846, T0893, eventually T0821 — and notably T0849 masquerading as monitoring software, which indicates an actor who expects the environment to be monitored and plans to remain.
The AI-assisted capability development materially widens the actor set rather than describing one group. The agencies are explicit that AI dramatically reduces the skill and time required to produce working ICS exploitation scripts and enables rapid adaptation to defensive measures. The practical consequence: the historical protective assumption — that ICS exploitation demands rare, specialized skill and therefore only nation-states could attempt it — no longer holds. Moderate-sophistication criminals, access brokers and hacktivists can generate functional tooling from public documentation, and snap7 gives them a tested foundation.
The refrigeration campaign is the hacktivist-shaped variant in the wild. Exposed controller, default or bypassed auth, fast visible action rather than patient pre-positioning, physical and financial impact designed to be noticed. Where the S7 advisory describes dwelling, the cold-chain incident describes what a low-effort, high-publicity actor does on arrival.
Integrator and vendor-adjacent access is the class hardest to separate from the threat, and the advisory makes the point directly: asset owners working with third-party providers may not realize their systems are exposed. An integrator's engineering workstation presents a programming-device role TSAP, downloads blocks, and does so from an address the asset owner may not recognize — the same observable profile as the threat. The discriminator is never the traffic; it is whether an authorization record exists. An uncorrelated integrator session is a finding, not noise to suppress.
Data Sources Required
Network: full-payload PCAP on every segment carrying TCP 102 and the controller management interfaces — non-negotiable, because S7 function codes cannot be recovered from truncated capture or flow records; NetFlow/IPFIX from OT-facing switches and firewalls for connection-level coverage where full capture is unavailable; firewall permit/deny logs for every path toward port 102 and controller management ports, including the perimeter rules the advisory recommends auditing; SNMP counters and trap-receiver logs from switches facing the controllers; web and reverse-proxy logs for every Danfoss management interface, covering xml.cgi, load_nginx_headers, and SMTP configuration endpoints.
Endpoint: CrowdStrike Falcon from engineering workstations, jump hosts, historians and any Level 3 host with a route to controllers — specifically ProcessRollup2, SyntheticProcessRollup2, NetworkConnectIP4, NetworkReceiveAcceptIP4, ModuleLoad, the file-write family, DnsRequest, UserLogon, UserLogonFailed2. Windows Security and PowerShell Operational logs with command-line auditing (4688) and script block logging (4104), plus System 7045. Datadog Agent logs from OT Windows/Linux hosts with Live Process Monitoring where licensing and policy permit. Nozomi Arc telemetry on OT-locked workstations where an IT EDR cannot be installed.
OT/ICS: historian trends and SCADA alarm records for the window-required to establish whether any write produced a process effect; controller diagnostic buffers retrieved through engineering software rather than by active query; gold-copy project files, firmware baselines, and known-good configuration snapshots for every S7 and Danfoss controller, without which a snapshot diff has nothing to compare against; exports from every deployed OT platform per the collection notes above.
Vendor, change and access records: the full controller inventory with model and firmware version per device — the advisory makes firmware currency the first mitigation and this hunt requires the inventory as its population definition (anything below Danfoss R4.3.1 is presumptively vulnerable); engineering workstation inventory with TIA Portal/STEP 7 installation status; change management records covering the full window, since almost every discriminator in this plan reduces to whether an authorization record exists; maintenance window schedules; VPN and remote-access logs including integrator and vendor sessions; contractual inventory of which third parties hold remote access to which controllers.
External attack surface: read-only queries against Shodan, Censys and Netlas with keys by environment variable and unavailable engines recorded as coverage gaps; the CISA KEV catalog; and authoritative public IP allocations, ASN registrations, DNS zone data and cloud asset inventory. That last item is load-bearing rather than optional — without an authoritative ownership record an index hit cannot be attributed, and an unattributable hit is inconclusive, not negative. Because integrators frequently host connectivity on their own address space, the inventory must extend to provider-hosted assets.
Detection Signatures
The SIGMA rules span process creation, image load, network connection and file event so that a single logging gap cannot blind the whole set. Each requires an approved-workstation inventory maintained in the filter — the rules are only as good as that list.
```yaml
title: Snap7 Library Loaded Outside Approved Engineering Workstation
id: 3f8a1c74-52e9-4b60-a1d7-9c04e6b28f15
status: experimental
description: Detects the snap7 industrial automation library being loaded by a process, consistent with AI-generated S7 tooling masquerading as monitoring software per joint advisory AA26-231A. Requires an approved-engineering-workstation list in the filter.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
author: 1898 & Co. Threat Hunt Team
date: 2026/08/19
tags:
- attack.execution
- attack.t0834
- attack.defense_evasion
- attack.t0849
logsource:
category: image_load
product: windows
detection:
selection:
ImageLoaded|contains:
- 'snap7.dll'
- 'snap7'
filter_approved:
Computer|startswith:
- 'EWS'
condition: selection and not filter_approved
falsepositives:
- Approved OT monitoring or historian products that legitimately bundle snap7
- Integrator-supplied engineering tooling on a documented workstation
level: high
```
```yaml
title: Python or Script Host Connecting to Siemens S7 Controller on TCP 102
id: 6d2b9e05-7a41-48cf-b3e2-1f5807a9dc36
status: experimental
description: Detects a scripting interpreter establishing a connection to TCP port 102 (S7comm/ISO-on-TCP), consistent with AI-generated Python tooling built on snap7 rather than legitimate engineering software.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
author: 1898 & Co. Threat Hunt Team
date: 2026/08/19
tags:
- attack.execution
- attack.t0834
- attack.discovery
- attack.t0846
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 102
Image|endswith:
- '\python.exe'
- '\pythonw.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
condition: selection
falsepositives:
- Sanctioned Python-based historian collectors on approved hosts
- Vendor diagnostic tooling during a documented maintenance window
level: high
```
```yaml
title: S7comm Connection From Host Outside Sanctioned Engineering Set
id: 8c5f3d19-4e72-4a08-95b6-d20e1738ba47
status: experimental
description: Detects any connection to TCP port 102 from a host that is not an approved engineering workstation or historian, covering the reconnaissance and insecure-credential access described in AA26-231A.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
author: 1898 & Co. Threat Hunt Team
date: 2026/08/19
tags:
- attack.discovery
- attack.t0846
- attack.lateral_movement
- attack.t1694
logsource:
category: network_connection
detection:
selection:
DestinationPort: 102
filter_sanctioned:
SourceIp|cidr:
- '10.30.10.0/28'
condition: selection and not filter_sanctioned
falsepositives:
- Newly commissioned engineering workstations not yet added to the sanctioned range
- IEC 61850 MMS traffic, which shares TCP 102 and must be excluded by protocol-ID byte at sites running both
level: high
yaml
title: Snap7 Library or S7 Tooling Written to Disk
id: 1e7c04a6-9b38-4d52-8fa1-63d905c7e2b8
status: experimental
description: Detects the snap7 library or S7 client tooling written to a workstation, particularly to staging or user-writable paths, consistent with deployment of AI-generated exploitation tooling.
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
author: 1898 & Co. Threat Hunt Team
date: 2026/08/19
tags:
- attack.execution
- attack.t0834
- attack.resource_development
- attack.t1588.007
logsource:
category: file_event
product: windows
detection:
selection_name:
TargetFilename|contains:
- 'snap7'
- 'python-snap7'
selection_path:
TargetFilename|contains:
- '\Temp\'
- '\Downloads\'
- '\ProgramData\'
- '\Public\'
condition: selection_name and selection_path
falsepositives:
- Legitimate installation of an OT monitoring product bundling snap7 via a temporary staging directory
- Developer/integrator workstations where snap7 is an accepted dependency
level: medium
```
```yaml
title: Danfoss Controller Management Endpoint Accessed Outside Change Window
id: 4a9d2f61-3c85-4e0b-b7a4-95f18e2c6d03
status: experimental
description: Detects HTTP requests to Danfoss AK-SM 800A management endpoints associated with the code-of-the-day authentication bypass (CVE-2025-41450), Nginx headers.conf injection (CVE-2025-41452), and SMTP configuration changes (CVE-2025-41451).
references:
- https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
author: 1898 & Co. Threat Hunt Team
date: 2026/08/19
tags:
- attack.initial_access
- attack.t1190
- attack.execution
- attack.t1059
- attack.impact
logsource:
category: webserver
detection:
selection_cgi:
cs-uri-query|contains:
- 'xml.cgi'
- 'action=getauth'
selection_nginx:
cs-uri-query|contains: 'load_nginx_headers'
selection_smtp:
cs-uri-query|contains: 'smtp'
filter_change_window:
# Suppress documented maintenance windows via lookup
condition: (selection_cgi or selection_nginx or selection_smtp) and not filter_change_window
falsepositives:
- Legitimate administrative sessions during approved change windows
- Automated configuration management where documented and authorized
level: high
Snort/Suricata — local SIDs from 1,000,000. Set OT_NET to the controller range and EWS_NET to the approved workstation range. Validate every content offset against your own captures before enabling in blocking mode — the S7 function byte must fall at the parameter function position, not merely anywhere in the payload, and an unvalidated offset produces both false positives and false negatives:
alert tcp !$EWS_NET any -> $OT_NET 102 (msg:"S7comm PLCStop job from non-engineering host (T0813 Denial of Control)"; flow:to_server,established; content:"|03 00|"; offset:0; depth:2; content:"|32 01|"; distance:0; content:"|29|"; classtype:attempted-dos; sid:1000101; rev:1; reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a;)
alert tcp !$EWS_NET any -> $OT_NET 102 (msg:"S7comm program download from non-engineering host (T0843 Program Download)"; flow:to_server,established; content:"|03 00|"; offset:0; depth:2; content:"|32 01|"; distance:0; pcre:"/\x32\x01.{8}[\x1a\x1b\x1c]/s"; classtype:attempted-admin; sid:1000102; rev:1; reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a;)
alert tcp !$EWS_NET any -> $OT_NET 102 (msg:"S7comm program upload from non-engineering host (T0845 Program Upload)"; flow:to_server,established; content:"|03 00|"; offset:0; depth:2; content:"|32 01|"; distance:0; pcre:"/\x32\x01.{8}[\x1d\x1e\x1f]/s"; classtype:attempted-recon; sid:1000103; rev:1; reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a;)
alert tcp any any -> $OT_NET 102 (msg:"Sequential S7 connection attempts consistent with port 102 scanning"; flow:to_server; flags:S; detection_filter:track by_src, count 10, seconds 60; classtype:attempted-recon; sid:1000104; rev:1; reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a;)
alert tcp !$EWS_NET any -> $OT_NET 102 (msg:"S7CommPlus session from non-engineering host - programming-session indicator"; flow:to_server,established; content:"|03 00|"; offset:0; depth:2; content:"|72|"; distance:5; within:3; threshold:type limit, track by_src, count 1, seconds 600; classtype:attempted-admin; sid:1000105; rev:1;)
alert tcp any any -> $DANFOSS_NET $HTTP_PORTS (msg:"Danfoss AK-SM management request to getauth endpoint (CVE-2025-41450 abuse)"; flow:to_server,established; content:"xml.cgi"; http_uri; content:"getauth"; http_uri; classtype:attempted-admin; sid:1000110; rev:1; reference:url,claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers;)
alert tcp any any -> $DANFOSS_NET $HTTP_PORTS (msg:"Danfoss Nginx headers.conf injection attempt (CVE-2025-41452)"; flow:to_server,established; content:"load_nginx_headers"; http_uri; classtype:attempted-admin; sid:1000111; rev:1; reference:url,claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers;)
YARA — snap7 masquerading tooling. The condition requires a snap7 import together with an S7-specific API call and a controller-addressing artifact, because any one alone matches legitimate automation code. The masquerading branch is separated deliberately: a script importing snap7 that also names itself as monitoring/telemetry software matches the advisory's specific T0849 behavior and warrants a different escalation path from ordinary snap7 usage. The file-size ceiling keeps the rule off large compiled applications that merely bundle the library.
```yara
rule S7_Snap7_Masquerading_Client_Tool
{
meta:
description = "Script or tool built on snap7/python-snap7 that addresses Siemens S7 controllers, including variants masqueraded as OT monitoring software (joint advisory AA26-231A)"
author = "1898 & Co. Threat Hunt Team"
date = "2026-08-19"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a"
strings:
$imp1 = "import snap7" ascii nocase
$imp2 = "from snap7" ascii nocase
$imp3 = "snap7.dll" ascii nocase
$imp4 = "libsnap7" ascii nocase
$api1 = "Cli_ConnectTo" ascii
$api2 = "db_read" ascii nocase
$api3 = "db_write" ascii nocase
$api4 = "read_area" ascii nocase
$api5 = "write_area" ascii nocase
$api6 = "plc_stop" ascii nocase
$api7 = "full_upload" ascii nocase
$addr1 = "rack" ascii nocase
$addr2 = "slot" ascii nocase
$addr3 = ":102" ascii
$masq1 = "monitor" ascii nocase
$masq2 = "telemetry" ascii nocase
$masq3 = "collector" ascii nocase
$masq4 = "watchdog" ascii nocase
condition:
filesize < 2MB and
any of ( $imp* ) and
(
( any of ( $api* ) and any of ( $addr* ) )
or ( any of ( $api* ) and any of ( $masq* ) )
)
}
```
YARA - in-memory session artifacts. A script can be run from memory, deleted after execution, or delivered by an interpreter that never wrote it to disk. The condition anchors on snap7 client symbols in the loaded library's export table alongside a live session artifact, requiring two S7 API strings rather than one so mere library presence in a legitimate process's address space does not match. Scanning another process's memory requires SeDebugPrivilege on Windows; Falcon RTR can execute remotely.
```yara
rule S7_Client_Session_Memory_Artifacts
{
meta:
description = "In-memory artifacts of an active snap7-based S7comm client session against a Siemens controller"
author = "1898 & Co. Threat Hunt Team"
date = "2026-08-19"
reference = "https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a"
strings:
$sym1 = "Cli_ConnectTo" ascii wide
$sym2 = "Cli_DBRead" ascii wide
$sym3 = "Cli_DBWrite" ascii wide
$sym4 = "Cli_PlcStop" ascii wide
$sym5 = "Cli_FullUpload" ascii wide
$sym6 = "Cli_Download" ascii wide
$sess1 = "ISO-on-TCP" ascii wide nocase
$sess2 = "S7comm" ascii wide nocase
$sess3 = { 03 00 00 16 11 E0 }
$lib = "snap7" ascii wide nocase
condition:
$lib and
2 of ( $sym* ) and
any of ( $sess1, $sess2, $sess3 )
}
```
YARA — credential-dumping memory artifacts. Required because this hunt covers lateral movement (T1694) and the engineering workstations in scope are high-value credential targets whose compromise is the most likely route to a controller that is not directly exposed. Scope note: this rule targets Windows LSASS tooling and will not match Linux credential dumping from /proc (T1003.007) — on Linux engineering hosts, the preceding rules plus endpoint process telemetry carry that coverage.
```yara
rule Credential_Dump_Tool_Memory_Artifacts
{
meta:
description = "In-memory artifacts of common credential-dumping tooling on engineering workstations and jump hosts with a route to S7 controllers"
author = "1898 & Co. Threat Hunt Team"
date = "2026-08-19"
reference = "https://attack.mitre.org/techniques/T1003/001/"
strings:
$mk1 = "sekurlsa::logonpasswords" ascii wide nocase
$mk2 = "lsadump::sam" ascii wide nocase
$mk3 = "privilege::debug" ascii wide nocase
$mk4 = "mimikatz" ascii wide nocase
$mkh = { 6D 69 6D 69 6B 61 74 7A }
$wce1 = "wce.exe" ascii wide nocase
$gs1 = "gsecdump" ascii wide nocase
$cs1 = "MiniDump" ascii wide nocase
$cs2 = "comsvcs" ascii wide nocase
$api1 = "NtReadVirtualMemory" ascii wide
$api2 = "ReadProcessMemory" ascii wide
$lsass = "lsass.exe" ascii wide nocase
condition:
any of ( $mk1, $mk2, $mk3, $mk4, $mkh )
or ( $wce1 and $lsass )
or $gs1
or ( $cs1 and $cs2 and $lsass )
or ( any of ( $api1, $api2 ) and $lsass and any of ( $mk4, $wce1, $gs1, $cs2 ) )
}
```
Indicators of Compromise
Neither source publishes network or file indicators. Every indicator below is behavioral by necessity, and this is a defining property of the hunt rather than a gap in it. A hunt that waits for a signature here will find nothing.
Category Indicator Source Hunt Leg
Exposure Danfoss StoreView management interface reachable from the internet Claroty Team82 / campaign reporting H1
Exposure Siemens S7 TCP 102 service visible in Shodan/Censys/Netlas AA26-231A H1
Exposure Firmware below Danfoss R4.3.1 Claroty / Danfoss H1
Exposure Default or absent authentication on any controller AA26-231A H1, H2
Behavior .cgi requests to getauth with hidden redacted attributes (code-of-the-day path) CVE-2025-41450 H2
Behavior load_nginx_headers invoked outside a change window CVE-2025-41452 H2
Behavior SMTP config update touching the email auth password field CVE-2025-41451 H2
Behavior COTP connection request presenting programming-device source TSAP 0x01 from an unsanctioned host AA26-231A H2
Behavior BlockList 0x2F / GetBlockInfo 0x31 / GetDiagData 0x32 sweep from a non-EWS host AA26-231A H2
Behavior One source reaching >5 distinct controllers on 102 AA26-231A H2
Behavior Host resolving shodan/censys/zoomeye from inside the OT network AA26-231A H2
Tooling snap7.dll, libsnap7, import snap7 on a non-approved host AA26-231A H3
Tooling Python process speaking classic S7comm to a TIA-only S7-1500 AA26-231A H3
Tooling Process named monitor/telemetry/collector/watchdog speaking S7comm with no known product attribution T0849 H3
Impact WriteVar 0x05, download 0x1A–0x1C, upload 0x1D–0x1F, PLCStop 0x29, start 0x2B/0x2C from non-EWS AA26-231A H4
Impact Successful AckData (error class 0x00) paired to a write/download PDU AA26-231A H4
Impact Error class 0x87 (access denied) on control jobs — authentication probing AA26-231A H4
Impact Defrost/heating schedule changed to continuous; setpoints driven to maximum Campaign reporting H4
Impact Temperature excursion alarm correlated with a config change event Campaign reporting H4
Credential LSASS access with memory-read APIs + tool indicator T1003.001 H3/H4 support
Absence is not exoneration. Nozomi Guardian's head returns 10 rows unbounded; xDome under-reports session and byte counts silently; Dragos detections depend on Knowledge Pack currency; Armis and Forescout perform no function-code decode; Datadog and Falcon cannot see S7 payloads at all. Every coverage gap in this plan must be named in the report rather than left to look like a clean negative.
Remediation and Mitigation
Immediate — do these before the hunt finishes:
1. Patch the cold chain. Danfoss addressed the core flaws in firmware R4.3.1 and equivalent patches for related systems. Treat anything below R4.3.1 as actively vulnerable. Confirm AK-SC355-series patch parity with the vendor.
2. Remove controllers from the public internet. Vendors and CERT-FR advise disconnecting management consoles from direct internet access. Place cold-chain and process-control gear behind segmented local management networks with strict VPN or zero-trust access. This single control defeats the entire initial-access path for both campaigns.
3. Sweep for default and unconfigured authentication on every controller, including hidden or vendor-support mechanisms. The code-of-the-day path is a vendor feature; ensure it is not the only thing standing between the internet and an administrative session.
4. Audit perimeter and firewall rules toward TCP 102 and controller management ports, including rules that predate the current architecture and rules owned by integrators.
5. Audit for exposed controllers across the entire inventory, including integrator and MSP-owned address space, and include acquisition and franchise estates — the refrigeration campaign hit "hundreds of European and international retail locations," which is exactly the profile of an estate with delegated IT and no central exposure register.
Structural:
6. A hardware and firmware inventory per site. You cannot patch or segment what you have not enumerated, and the advisory makes firmware currency the first mitigation.
7. An approved engineering workstation register. Every SIGMA rule above depends on it. It is also the only durable discriminator between a legitimate integrator and an actor behaving identically.
8. Maintain gold-copy project files and known-good configuration snapshots for every controller. Without a baseline, a code-snapshot diff has nothing to compare against and the write detection degrades to guesswork.
9. Remove or rotate default SNMP community strings on OT assets, and enforce SNMPv3 authPriv. Treat any device still answering a default community as a finding.
10. Establish a change-record correlation workflow so that every write, download, or schedule change can be matched to an authorization in near-real-time rather than during the next audit.
11. Retain full-payload PCAP on port 102 and controller management interfaces as a standing capability, not a hunt-time scramble. Function codes cannot be recovered after the fact from flow data.
12. Reduce third-party exposure deliberately: inventory integrator access, require MFA on vendor remote paths, and contractually require notification when an integrator exposes a controller on its own address space.
Hunt Execution Order and Deliverables
Execute in this sequence — each step scopes the next:
1. Hypothesis 1 (external exposure, passive indices only). Output: an attributed list of exposed controllers and a named coverage gap for any estate you could not attribute. This result scopes everything else.
2. Hypothesis 2 (internal reconnaissance). Output: the sanctioned port 102 conversation baseline and the deviation list from it. Pivot every H1-confirmed controller into exhaustive review.
3. Hypothesis 3 (snap7 tooling). Output: the approved engineering population plus every host that touches port 102 and is not in it.
4. Hypothesis 4 (writes and impacts). Output: every control job and schedule change paired to an authorization record, with process-effect correlation for each confirmed successful write.
5. Detection tuning — promote validated queries to standing monitors, convert confirmed patterns to Custom IOAs and custom analytics, and publish the exposure finding regardless of whether any intrusion is found.
The expected headline finding is exposure, not intrusion. If Hypothesis 1 returns internet-reachable Danfoss controllers below R4.3.1 or Siemens CPUs on open 102, that is a reportable condition and a presumptive target-selection finding independent of any observed exploitation — precisely because the actors locate targets by reading the same indices, and because continuous exposure means the asset has been on a published target list for the entire window. Read-only S7comm findings must be escalated with the same seriousness as writes: the authoring agencies assess the reads as pre-positioning for effects, and the refrigeration campaign is a demonstration of what those effects look like when the same access path is used against a physical process with no authentication in the way.
References:
1. Claroty Team82, "Freeze the Controller, Defrost the Food: Uncovering Vulnerabilities in Danfoss Refrigeration Controllers," August 9, 2026. https://claroty.com/team82/research/freeze-the-controller-defrost-the-food-uncovering-vulnerabilities-in-danfoss-refrigeration-controllers
2. NSA/CISA/FBI/DOE/EPA Joint Advisory AA26-231A, "AI-Assisted S7comm Exploitation and Internet-Exposed Siemens S7 Series PLCs," August 19, 2026.
3. 1898 & Co. Advisory, "Threat Hunt Plan: Siemens S7 Series PLCs," August 19, 2026. https://1898advisories.burnsmcd.com/threat-hunt-plan-siemens-s7-series-plcs-ai-assisted-s7comm-exploitation-snap7-masquerading-tools-and-internet-exposure
4. Campaign reporting on commercial refrigeration sabotage, including European retail impact, controller lockdown into defrost/heating cycles, and the 50°C–80°C temperature excursions.
5. CERT-FR advisory on cold-chain controller exposure and network isolation.
6. CISA Known Exploited Vulnerabilities catalog. https://www.cisa.gov/known-exploited-vulnerabilities-catalog
