mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-06-11 21:54:56 +03:00
mukul975
c21af3347e
- Add scripts/agent.py and references/api-reference.md to all remaining skills - Update all 648 LICENSE files: copyright now reads 'Mahipal' - Add implementing-security-monitoring-with-datadog (new skill with full anatomy) - All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md
98 lines
2.2 KiB
Markdown
98 lines
2.2 KiB
Markdown
# API Reference: Stuxnet-Style ICS Attack Detection
|
|
|
|
## Modbus TCP Protocol
|
|
|
|
### Frame Structure
|
|
| Offset | Size | Field |
|
|
|--------|------|-------|
|
|
| 0 | 2 | Transaction ID |
|
|
| 2 | 2 | Protocol ID (0x0000) |
|
|
| 4 | 2 | Length |
|
|
| 6 | 1 | Unit ID |
|
|
| 7 | 1 | Function Code |
|
|
| 8+ | var | Data |
|
|
|
|
### Write Function Codes (Attack-Relevant)
|
|
| Code | Name | Risk |
|
|
|------|------|------|
|
|
| 5 | Write Single Coil | Medium |
|
|
| 6 | Write Single Register | Medium |
|
|
| 15 | Write Multiple Coils | High |
|
|
| 16 | Write Multiple Registers | High |
|
|
| 22 | Mask Write Register | High |
|
|
|
|
## Siemens S7comm Protocol
|
|
|
|
### S7 Parameter Functions
|
|
| Code | Name |
|
|
|------|------|
|
|
| 0x04 | Read Variable |
|
|
| 0x05 | Write Variable |
|
|
| 0x1A | Request Download |
|
|
| 0x1B | Download Block |
|
|
| 0x1C | Download Ended |
|
|
| 0x28 | PLC Control (Start/Stop) |
|
|
|
|
## Wireshark/tshark Filters
|
|
|
|
### Modbus write operations
|
|
```bash
|
|
tshark -r capture.pcap -Y "modbus.func_code >= 5 && modbus.func_code <= 16"
|
|
```
|
|
|
|
### S7comm block downloads
|
|
```bash
|
|
tshark -r capture.pcap -Y "s7comm.param.func == 0x1a || s7comm.param.func == 0x1b"
|
|
```
|
|
|
|
### S7comm PLC stop/start
|
|
```bash
|
|
tshark -r capture.pcap -Y "s7comm.param.func == 0x28"
|
|
```
|
|
|
|
## Stuxnet IOC Signatures
|
|
|
|
### YARA Rule
|
|
```yara
|
|
rule Stuxnet_Driver {
|
|
meta:
|
|
description = "Stuxnet rootkit driver"
|
|
strings:
|
|
$mrxcls = "mrxcls.sys" ascii
|
|
$mrxnet = "mrxnet.sys" ascii
|
|
$mutex = "{A3BD0EA3-CD10-4258-8784-2F53E56E2010}"
|
|
condition:
|
|
any of them
|
|
}
|
|
```
|
|
|
|
### Registry Keys
|
|
```
|
|
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\MS-DOS Emulation
|
|
HKLM\SYSTEM\CurrentControlSet\Services\MRxCls
|
|
HKLM\SYSTEM\CurrentControlSet\Services\MRxNet
|
|
```
|
|
|
|
## Siemens Step 7 Project Structure
|
|
|
|
### Organization Blocks
|
|
| Block | Purpose |
|
|
|-------|---------|
|
|
| OB1 | Main program cycle |
|
|
| OB35 | 100ms cyclic interrupt |
|
|
| OB100 | Startup |
|
|
|
|
### File Extensions
|
|
| Extension | Content |
|
|
|-----------|---------|
|
|
| `.awl` | Statement List source |
|
|
| `.mc7` | Compiled machine code |
|
|
| `.s7p` | Project file |
|
|
|
|
## Snort/Suricata Rules for ICS
|
|
```
|
|
alert tcp any any -> any 502 (msg:"Modbus Write Multiple Registers";
|
|
content:"|00 00|"; offset:2; depth:2;
|
|
byte_test:1,=,16,7; sid:1000001;)
|
|
```
|