# Léargas OT — EtherNet/IP (CIP) detections for Rockwell / Allen-Bradley
#
# Motivated by CISA advisory AA26-097A (2026-04-07): Iranian-affiliated APT
# (IRGC-CEC / CyberAv3ngers) targeting internet-exposed Rockwell/Allen-Bradley
# PLCs (CompactLogix, Micro850) over EtherNet/IP. The campaign uses NO CVEs — it
# abuses internet exposure and legitimate engineering software (Studio 5000) to
# read/modify project files and HMI data. Detection therefore focuses on:
#   (1) EtherNet/IP recon/fingerprinting from the internet,
#   (2) sessions established from external space to an OT device,
#   (3) CIP write/config services sourced from external space.
# Exposure itself ("the PLC is reachable from the internet") is an attack-surface
# problem and is NOT detectable by an IDS rule — pair these with exposure/ASM.
#
# Requires Suricata's EtherNet/IP parser (disabled by default):
#   app-layer: { protocols: { enip: { enabled: yes, detection-ports: { dp: 44818 } } } }
#
# Keyword values are decimal. ENIP encapsulation commands and CIP service codes
# per the CIP specification. SIDs use the local 42044xxx (EtherNet/IP) range.

# --- (1) Reconnaissance: EtherNet/IP identity/service enumeration from the internet ---
alert enip $EXTERNAL_NET any -> $HOME_NET 44818 ( \
    msg:"LEARGAS OT RECON EtherNet/IP List Identity from external (Rockwell/AB PLC fingerprinting) - AA26-097A"; \
    enip_command:99; \
    classtype:attempted-recon; \
    reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a; \
    metadata:affected_product Rockwell_Allen_Bradley, tag OT, tag EtherNet_IP, mitre_attack_technique T0846, deployment Perimeter, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42044001; rev:1; \
)

alert enip $EXTERNAL_NET any -> $HOME_NET 44818 ( \
    msg:"LEARGAS OT RECON EtherNet/IP List Services from external"; \
    enip_command:4; \
    classtype:attempted-recon; \
    metadata:affected_product Rockwell_Allen_Bradley, tag OT, tag EtherNet_IP, mitre_attack_technique T0846, deployment Perimeter, signature_severity Warning, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42044002; rev:1; \
)

alert enip $EXTERNAL_NET any -> $HOME_NET 44818 ( \
    msg:"LEARGAS OT RECON EtherNet/IP List Interfaces from external"; \
    enip_command:100; \
    classtype:attempted-recon; \
    metadata:affected_product Rockwell_Allen_Bradley, tag OT, tag EtherNet_IP, mitre_attack_technique T0846, deployment Perimeter, signature_severity Warning, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42044003; rev:1; \
)

# --- (2) Internet-sourced EtherNet/IP session to an OT device ---
alert enip $EXTERNAL_NET any -> $HOME_NET 44818 ( \
    msg:"LEARGAS OT EtherNet/IP RegisterSession from external (internet-exposed PLC access) - AA26-097A"; \
    enip_command:101; \
    classtype:attempted-admin; \
    reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a; \
    metadata:affected_product Rockwell_Allen_Bradley, tag OT, tag EtherNet_IP, mitre_attack_technique T0886, deployment Perimeter, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42044004; rev:1; \
)

# --- (3) CIP write / config operations sourced from external space (manipulation) ---
# Change $EXTERNAL_NET to any to also surface internal engineering writes.
alert enip $EXTERNAL_NET any -> $HOME_NET 44818 ( \
    msg:"LEARGAS OT EtherNet/IP CIP Write Tag from external (possible PLC manipulation) - AA26-097A"; \
    cip_service:77; \
    classtype:attempted-admin; \
    reference:url,www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a; \
    metadata:affected_product Rockwell_Allen_Bradley, tag OT, tag EtherNet_IP, mitre_attack_technique T0836, deployment Perimeter, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42044010; rev:1; \
)

alert enip $EXTERNAL_NET any -> $HOME_NET 44818 ( \
    msg:"LEARGAS OT EtherNet/IP CIP Set_Attribute_Single from external (config write)"; \
    cip_service:16; \
    classtype:attempted-admin; \
    metadata:affected_product Rockwell_Allen_Bradley, tag OT, tag EtherNet_IP, mitre_attack_technique T0836, deployment Perimeter, signature_severity Major, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42044011; rev:1; \
)

alert enip $EXTERNAL_NET any -> $HOME_NET 44818 ( \
    msg:"LEARGAS OT EtherNet/IP CIP Forward Open from external (connection to controller)"; \
    cip_service:84; \
    classtype:protocol-command-decode; \
    metadata:affected_product Rockwell_Allen_Bradley, tag OT, tag EtherNet_IP, mitre_attack_technique T0886, deployment Perimeter, signature_severity Warning, created_at 2026_08_10; \
    target:dest_ip; \
    sid:42044012; rev:1; \
)