Skip to main content
S7 is a proprietary communication protocol developed by Siemens for their S7 family of PLCs (S7-300, S7-400, S7-1200, S7-1500). Siemens PLCs control critical processes across energy generation, water treatment, automotive manufacturing, chemical processing, and pharmaceutical production globally.

​
How S7 works

S7 runs on port 102 using the ISO-TSAP transport layer. Like Modbus, earlier versions of S7 (S7-300/400) have no built-in authentication. S7-1200 and S7-1500 added optional access protection, but default configurations frequently leave it disabled. The protocol supports reading and writing data blocks, program blocks, and system state. A Siemens STEP 7 or TIA Portal engineering workstation communicates with PLCs using S7 to upload/download programs and monitor process values.

​
The Stuxnet connection

S7 gained global attention as the target of Stuxnet (2010). The malware specifically targeted Siemens S7-315 and S7-417 PLCs controlling Iranian uranium enrichment centrifuges. Stuxnet intercepted S7 communications to:
  1. Read the current state of centrifuge operations
  2. Inject malicious command sequences that altered rotor speeds
  3. Replay recorded normal operation data to the SCADA system, hiding the attack
Stuxnet demonstrated that S7-exposed systems could be compromised without any network visibility to operators.

​
What Reyhford observes

S7 (port 102) is consistently the highest-volume protocol in our honeypot network, accounting for the majority of ICS-specific attack traffic. Observed attack patterns:
  • CPU state requests — probing PLC operational state and firmware version
  • Data block enumeration — reading DB1, DB2, etc. to extract process configuration
  • System function calls — SZL (System Status List) requests to fingerprint hardware
  • Write attempts — less common but present; attempts to modify data block values
The volume of S7 scanning reflects both the protocol’s industrial prevalence and the availability of open-source S7 scanning tools. MITRE ATT&CK for ICS mapping: T0855 (Unauthorized Command Message), T0814 (Inhibit Response Function).