Microsoft Section52 ICS Forensics tools

INTRODUCTION

Microsoft Section52 ICS Forensics Tools is an open source forensic toolkit for analyzing Industrial PLC metadata and project files. Microsoft Section52 ICS Forensics Tools enables investigators to identify suspicious artifacts on ICS environment for detection of compromised devices during incident response or manual check. Microsoft Section52 ICS Forensics Tools is open source, which allows investigators to verify the actions of the tool or customize it to specific needs, currently support Siemens S7 via Snap7.

SUPPORTED SCENARIOS

• OB usage
• Block author
• Offline - Online comparison
• Call Graphs
• Timestamps outliers
• Network usage

Executing and arguments

This tool requires Python 3.8 or later.

Install required Python packages

pip install -r requirements.txt

The arguments:

args	Description	Must / Optional
-h, --help	show this help message and exit	----
-fo, --file_output	Store output in file	optional
-v, --verbose	Verbose logging	optional
-if, --ip_addresses_file	IP addresses file to scan	optional
-sc, --scan	Scan for Siemens S7 PLCs in network segment (x.y.z.)	optional
-ov, --override_output_dirs	Override output directories	optional , default - True
-pn, --port_number	Port number for connecting or scanning	optional, default - 102
-co, --compare_online_vs_offline	Compare between online and offline projects	optional
-ci, --compare_ip	PLC IP with online blocks to compare	optional
-opd, --offline_projects_directory	Offline projects directory	optional
-opdn, --offline_project_dir_name	Offline project directory name	optional
-la, --logic_all	Execute all logic options	optional
-lau, --logic_author	Execute author logic	optional
-ld, --logic_dates	Execute dates logic	optional
-ln, --logic_network	Execute network logic	optional
-lo, --logic_ob	Execute organizational blocks logic	optional

Executing examples:

 ./main.py -i 192.168.88.1 -la
 ./main.py -i 192.168.88.1 -pn 220 -la
 ./main.py -ci 192.168.88.1 -co -opd '\s7_proj' -opdn '\s7_proj'

Output:

Depending on the model you choose to investigate, the data presented per model

• Upload project from PLC and parsing status

• Author block names and uniqueness -
  
  
  
  

• Timestamp Outliers Anomalies
  
  
  
  

• Network Logic
  
  
  
  

• Call graph - program connection base execution graph
  
  
  

- OB metadata

- Online <-> Offline Block Comparison

Resources and Technical data & solution:

Microsoft Defender for IoT is an agentless network-layer security solution that allows organizations to continuously monitor and discover assets, detect threats, and manage vulnerabilities in their IoT/OT and Industrial Control Systems (ICS) devices, on-premises and in Azure-connected environments.

Section 52 under MSRC blog
ICS Lecture given about the tool
Section 52 - Investigating Malicious Ladder Logic | Microsoft Defender for IoT Webinar - YouTube

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

Legal Disclaimer

Copyright (c) 2018 Microsoft Corporation. All rights reserved.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.