Intrusion PreventionModbus.TCP.Points.List.Scan
Description
This indicates that a read or write request was sent to an address that is not configured in the Modbus TCP server.
Modbus TCP is a protocol commonly used in SCADA and DCS networks for process control. Read and write requests are issued to a Modbus TCP server to address points which can be individual bits (coils and discrete inputs) or bytes (registers). These points represent measurements or control of a physical process. If a read or write request is made to an address that is not configured in the Modbus TCP server the server will respond with an error function code and exception code 02. It would be an unusual error for an authorized HMI or server to issue a read or write request to an address that is not configured.
Affected Products
Modbus servers, such as PLCs and RTUs.
Impact
System compromise: reconnaissance.
Recommended Actions
Deploy access control lists or firewalls to only allow access from authorized IP addresses.
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 15287 |
| Created | Jan 10, 2008 |
| Updated | Jul 06, 2022 |
| Risk |
|
| Default Action | pass |
| Active | |
| Affected OS | Other |
| Affected App | SCADA |