Modbus.TCP.Report.Server.Info
Description
This indicates that an attacker may have attempted to get information from a PLC or other Modbus server by issuing the "Report Slave ID" request.
Modbus TCP is a protocol often found in SCADA networks where it is used for process control. A "Report Slave" request will reveal device specific information that could be used to mount further attacks.
Affected Products
PLCs and Modbus TCP servers.
Impact
Information disclosure.
Recommended Actions
Investigate the source of the traffic to determine if it is malicious in nature.
Telemetry
Coverage
IPS (Regular DB) | |
IPS (Extended DB) |