Skip to content

Latest commit

 

History

History
139 lines (105 loc) · 6.6 KB

README.md

File metadata and controls

139 lines (105 loc) · 6.6 KB
Raw


Microsoft Section52 ICS Forensics tools

INTRODUCTION

Microsoft Section52 ICS Forensics Tools is an open source forensic toolkit for analyzing Industrial PLC metadata and project files. Microsoft Section52 ICS Forensics Tools enables investigators to identify suspicious artifacts on ICS environment for detection of compromised devices during incident response or manual check. Microsoft Section52 ICS Forensics Tools is open source, which allows investigators to verify the actions of the tool or customize it to specific needs, currently support Siemens S7 via Snap7.

SUPPORTED SCENARIOS

  • OB usage
  • Block author
  • Offline - Online comparison
  • Call Graphs
  • Timestamps outliers
  • Network usage

Executing and arguments

This tool requires Python 3.8 or later.

Install required Python packages

pip install -r requirements.txt

The arguments:

args Description Must / Optional
-h, --help show this help message and exit ----
-fo, --file_output Store output in file optional
-v, --verbose Verbose logging optional
-if, --ip_addresses_file IP addresses file to scan optional
-sc, --scan Scan for Siemens S7 PLCs in network segment (x.y.z.) optional
-ov, --override_output_dirs Override output directories optional , default - True
-pn, --port_number Port number for connecting or scanning optional, default - 102
-co, --compare_online_vs_offline Compare between online and offline projects optional
-ci, --compare_ip PLC IP with online blocks to compare optional
-opd, --offline_projects_directory Offline projects directory optional
-opdn, --offline_project_dir_name Offline project directory name optional
-la, --logic_all Execute all logic options optional
-lau, --logic_author Execute author logic optional
-ld, --logic_dates Execute dates logic optional
-ln, --logic_network Execute network logic optional
-lo, --logic_ob Execute organizational blocks logic optional

Executing examples:

 ./main.py -i 192.168.88.1 -la
 ./main.py -i 192.168.88.1 -pn 220 -la
 ./main.py -ci 192.168.88.1 -co -opd '\s7_proj' -opdn '\s7_proj'

Output:

Depending on the model you choose to investigate, the data presented per model

  • Upload project from PLC and parsing status

  • Author block names and uniqueness -



  • Timestamp Outliers Anomalies



  • Network Logic



  • Call graph - program connection base execution graph



- OB metadata



- Online <-> Offline Block Comparison



Resources and Technical data & solution:

Microsoft Defender for IoT is an agentless network-layer security solution that allows organizations to continuously monitor and discover assets, detect threats, and manage vulnerabilities in their IoT/OT and Industrial Control Systems (ICS) devices, on-premises and in Azure-connected environments.

Section 52 under MSRC blog
ICS Lecture given about the tool
Section 52 - Investigating Malicious Ladder Logic | Microsoft Defender for IoT Webinar - YouTube

Contributing

This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.opensource.microsoft.com.

When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.

This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact [email protected] with any additional questions or comments.

Trademarks

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

Legal Disclaimer

Copyright (c) 2018 Microsoft Corporation. All rights reserved.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.