← LibraryTechnique entry
OT-S7-SIEMENSImpact
Siemens S7 Protocol Abuse
S7-300/400/1200/1500 PLCs respond to S7comm — read/write data blocks, stop/start CPU, transfer logic without auth (legacy) or with default password.
§ Where this technique fits
OT-S7-SIEMENS is catalogued under the Impact tactic of the offensive-security kill-chain. It appears in 2 approved dossiers in the registry, typically at step 4 on average.
§ Dossiers chaining this technique
- step 4 / 5
TRITON-class SIS reprogram → disable safety shutdown
After OT-network foothold, reach a Triconex Safety Instrumented System. Download attacker logic that suppresses safety trips on a process that's about to be pushed past its safe envelope.
- step 4 / 6
Engineering workstation → push payload to PLC
Compromise the OT engineer's laptop (corporate-network adjacent, jumphost-reachable). Use legit engineering tools (TIA Portal / Studio 5000) to download attacker ladder logic to the PLC.
§ What commonly comes next
- 01Data Encrypted for Impactseen 1×T1486 · Impact
- 02Modbus TCP Write to PLCseen 1×OT-MODBUS-WRITE · Impact