[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ETENFWRM01WKMACVDPA1VW":3,"skill-same:01M6ETENFWRM01WKMACVDPA1VW":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":69,"commitSha":70,"skillDirectory":71,"forksCount":14,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":6,"ownerDescription":75,"updatedAt":76,"install":77,"resources":90},"01M6ETENFWRM01WKMACVDPA1VW","detecting-modbus-command-injection-attacks",null,"Detect command injection attacks against Modbus TCP\u002FRTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines using ICS-aware IDS and protocol deep packet inspection.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-modbus-command-injection-attacks\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"command injection","modbus","detecting modbus command injection attacks","command","injection","de","cybersecurity","deep","malformed","cm","write","ICS-security","analysis","t1078","ids","threat-detection","protocol-analysis","monitoring","tcp","communication","2026-11-10 10:12:30",false,"---\nname: detecting-modbus-command-injection-attacks\ndescription: 'Detect command injection attacks against Modbus TCP\u002FRTU protocol in\n  ICS environments by monitoring for unauthorized write operations, anomalous function\n  codes, malformed frames, and deviations from established communication baselines\n  using ICS-aware IDS and protocol deep packet inspection.\n\n  '\ndomain: cybersecurity\nsubdomain: ot-ics-security\ntags:\n- ot-security\n- ics\n- modbus\n- command-injection\n- protocol-analysis\n- ids\n- scada\n- threat-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-05\n- GV.OC-02\nmitre_attack:\n- T1078\n- T1190\n- T1059\n- T1055\n- T0816\n---\n\n# Detecting Modbus Command Injection Attacks\n\n## When to Use\n\n- When deploying intrusion detection for environments using Modbus TCP (port 502) or Modbus RTU\n- When investigating suspected unauthorized modifications to PLC registers or coils\n- When building detection analytics for OT SOC monitoring Modbus-heavy environments\n- When responding to FrostyGoop-style attacks that leverage Modbus TCP for operational impact\n- When performing baseline validation after a suspected compromise of a Modbus master\n\n**Do not use** for detecting attacks on non-Modbus protocols (see detecting-dnp3-protocol-anomalies for DNP3), for general IT network intrusion detection, or for Modbus device configuration (see performing-ot-vulnerability-scanning-safely).\n\n## Prerequisites\n\n- Network SPAN\u002FTAP on the segment carrying Modbus TCP traffic (typically port 502)\n- Baseline of normal Modbus communication patterns (masters, slaves, function codes, register ranges, polling intervals)\n- Suricata, Zeek, or commercial OT IDS deployed with Modbus protocol parsers enabled\n- Understanding of Modbus function codes used in the environment (read vs write operations)\n- Access to PLC programming documentation to validate expected register ranges\n\n## Workflow\n\n### Step 1: Build Modbus Communication Baseline\n\nCapture and analyze normal Modbus traffic to establish what constitutes legitimate communication patterns.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Modbus Command Injection Detector.\n\nMonitors Modbus TCP traffic for unauthorized write operations, anomalous\nfunction codes, and deviations from established communication baselines.\nDetects attacks like FrostyGoop that use Modbus TCP for operational impact.\n\"\"\"\n\nimport json\nimport struct\nimport sys\nimport time\nfrom collections import defaultdict\nfrom datetime import datetime\nfrom typing import Dict, List, Optional, Set, Tuple\n\ntry:\n    from scapy.all import sniff, IP, TCP\nexcept ImportError:\n    print(\"Install scapy: pip install scapy\")\n    sys.exit(1)\n\n\n# Modbus function code definitions\nMODBUS_READ_FUNCTIONS = {1, 2, 3, 4}\nMODBUS_WRITE_FUNCTIONS = {5, 6, 15, 16}\nMODBUS_DIAGNOSTIC_FUNCTIONS = {8, 17, 43}\n\nMODBUS_FUNC_NAMES = {\n    1: \"Read Coils\", 2: \"Read Discrete Inputs\",\n    3: \"Read Holding Registers\", 4: \"Read Input Registers\",\n    5: \"Write Single Coil\", 6: \"Write Single Register\",\n    8: \"Diagnostics\", 15: \"Write Multiple Coils\",\n    16: \"Write Multiple Registers\", 17: \"Report Slave ID\",\n    22: \"Mask Write Register\", 23: \"Read\u002FWrite Multiple Registers\",\n    43: \"Encapsulated Interface Transport\",\n}\n\n\nclass ModbusAlert:\n    \"\"\"Represents a detected Modbus anomaly.\"\"\"\n\n    def __init__(self, severity: str, alert_type: str, src_ip: str,\n                 dst_ip: str, unit_id: int, func_code: int,\n                 description: str, mitre_technique: str = \"\"):\n        self.timestamp = datetime.now().isoformat()\n        self.severity = severity\n        self.alert_type = alert_type\n        self.src_ip = src_ip\n        self.dst_ip = dst_ip\n        self.unit_id = unit_id\n        self.func_code = func_code\n        self.func_name = MODBUS_FUNC_NAMES.get(func_code, f\"Unknown FC {func_code}\")\n        self.description = description\n        self.mitre_technique = mitre_technique\n\n    def __str__(self):\n        return (\n            f\"[{self.severity}] {self.alert_type} | {self.src_ip} -> {self.dst_ip} \"\n            f\"| Unit {self.unit_id} | {self.func_name} | {self.description}\"\n        )\n\n\nclass ModbusInjectionDetector:\n    \"\"\"Detects Modbus command injection attacks.\"\"\"\n\n    def __init__(self, baseline_file: Optional[str] = None):\n        self.alerts: List[ModbusAlert] = []\n        self.packet_count = 0\n        self.modbus_count = 0\n\n        # Baseline data\n        self.authorized_masters: Set[str] = set()\n        self.authorized_pairs: Set[Tuple[str, str]] = set()\n        self.allowed_write_sources: Set[str] = set()\n        self.allowed_function_codes: Dict[str, Set[int]] = defaultdict(set)\n        self.allowed_register_ranges: Dict[str, List[Tuple[int, int]]] = defaultdict(list)\n        self.polling_intervals: Dict[str, float] = {}\n        self.last_seen: Dict[str, float] = {}\n\n        # Counters for rate detection\n        self.write_counts: Dict[str, List[float]] = defaultdict(list)\n\n        if baseline_file:\n            self.load_baseline(baseline_file)\n\n    def load_baseline(self, filepath: str):\n        \"\"\"Load established Modbus communication baseline.\"\"\"\n        with open(filepath, \"r\") as f:\n            baseline = json.load(f)\n\n        for session_key, data in baseline.get(\"modbus_baselines\", {}).items():\n            src, dst = session_key.split(\"->\")\n            self.authorized_pairs.add((src.strip(), dst.strip()))\n            self.authorized_masters.add(src.strip())\n\n            fc_set = set(data.get(\"allowed_function_codes\", []))\n            self.allowed_function_codes[session_key] = fc_set\n\n            if fc_set & MODBUS_WRITE_FUNCTIONS:\n                self.allowed_write_sources.add(src.strip())\n\n            for reg_range in data.get(\"register_ranges\", []):\n                self.allowed_register_ranges[session_key].append(\n                    (reg_range[\"start\"], reg_range[\"end\"])\n                )\n\n            if data.get(\"polling_interval_avg_sec\"):\n                self.polling_intervals[session_key] = data[\"polling_interval_avg_sec\"]\n\n        print(f\"[*] Baseline loaded: {len(self.authorized_pairs)} authorized pairs, \"\n              f\"{len(self.allowed_write_sources)} authorized write sources\")\n\n    def parse_modbus_mbap(self, payload: bytes) -> Optional[dict]:\n        \"\"\"Parse Modbus TCP MBAP header and PDU.\"\"\"\n        if len(payload) \u003C 8:\n            return None\n\n        transaction_id = struct.unpack(\">H\", payload[0:2])[0]\n        protocol_id = struct.unpack(\">H\", payload[2:4])[0]\n        length = struct.unpack(\">H\", payload[4:6])[0]\n        unit_id = payload[6]\n        func_code = payload[7]\n\n        if protocol_id != 0:  # Not Modbus\n            return None\n\n        result = {\n            \"transaction_id\": transaction_id,\n            \"protocol_id\": protocol_id,\n            \"length\": length,\n            \"unit_id\": unit_id,\n            \"func_code\": func_code,\n        }\n\n        # Parse register address and count for read\u002Fwrite operations\n        if len(payload) >= 12 and func_code in (1, 2, 3, 4, 5, 6, 15, 16):\n            result[\"start_address\"] = struct.unpack(\">H\", payload[8:10])[0]\n            result[\"quantity\"] = struct.unpack(\">H\", payload[10:12])[0]\n\n        return result\n\n    def analyze_packet(self, pkt):\n        \"\"\"Analyze a network packet for Modbus command injection.\"\"\"\n        self.packet_count += 1\n\n        if not pkt.haslayer(IP) or not pkt.haslayer(TCP):\n            return\n\n        tcp = pkt[TCP]\n        if tcp.dport != 502 and tcp.sport != 502:\n            return\n\n        payload = bytes(tcp.payload)\n        if not payload:\n            return\n\n        modbus = self.parse_modbus_mbap(payload)\n        if not modbus:\n            return\n\n        self.modbus_count += 1\n        src_ip = pkt[IP].src\n        dst_ip = pkt[IP].dst\n        session_key = f\"{src_ip}->{dst_ip}\"\n        now = time.time()\n\n        # Detection Rule 1: Unauthorized Modbus master\n        if self.authorized_masters and src_ip not in self.authorized_masters:\n            if tcp.dport == 502:\n                self.alerts.append(ModbusAlert(\n                    severity=\"CRITICAL\",\n                    alert_type=\"UNAUTHORIZED_MASTER\",\n                    src_ip=src_ip, dst_ip=dst_ip,\n                    unit_id=modbus[\"unit_id\"],\n                    func_code=modbus[\"func_code\"],\n                    description=f\"Unauthorized device {src_ip} sending Modbus commands to {dst_ip}\",\n                    mitre_technique=\"T0843 - Program Download\",\n                ))\n\n        # Detection Rule 2: Unauthorized write operation\n        if modbus[\"func_code\"] in MODBUS_WRITE_FUNCTIONS:\n            if self.allowed_write_sources and src_ip not in self.allowed_write_sources:\n                self.alerts.append(ModbusAlert(\n                    severity=\"CRITICAL\",\n                    alert_type=\"UNAUTHORIZED_WRITE\",\n                    src_ip=src_ip, dst_ip=dst_ip,\n                    unit_id=modbus[\"unit_id\"],\n                    func_code=modbus[\"func_code\"],\n                    description=f\"Write command from non-authorized source {src_ip}\",\n                    mitre_technique=\"T0855 - Unauthorized Command Message\",\n                ))\n\n            # Track write frequency for rate anomaly detection\n            self.write_counts[src_ip].append(now)\n            recent_writes = [t for t in self.write_counts[src_ip] if now - t \u003C 60]\n            self.write_counts[src_ip] = recent_writes\n            if len(recent_writes) > 20:\n                self.alerts.append(ModbusAlert(\n                    severity=\"HIGH\",\n                    alert_type=\"WRITE_FLOOD\",\n                    src_ip=src_ip, dst_ip=dst_ip,\n                    unit_id=modbus[\"unit_id\"],\n                    func_code=modbus[\"func_code\"],\n                    description=f\"Excessive write rate: {len(recent_writes)} writes in 60s from {src_ip}\",\n                    mitre_technique=\"T0836 - Modify Parameter\",\n                ))\n\n        # Detection Rule 3: Anomalous function code\n        if session_key in self.allowed_function_codes:\n            if modbus[\"func_code\"] not in self.allowed_function_codes[session_key]:\n                self.alerts.append(ModbusAlert(\n                    severity=\"HIGH\",\n                    alert_type=\"ANOMALOUS_FUNCTION_CODE\",\n                    src_ip=src_ip, dst_ip=dst_ip,\n                    unit_id=modbus[\"unit_id\"],\n                    func_code=modbus[\"func_code\"],\n                    description=(\n                        f\"Function code {modbus['func_code']} ({MODBUS_FUNC_NAMES.get(modbus['func_code'], 'Unknown')}) \"\n                        f\"not in baseline for {session_key}\"\n                    ),\n                    mitre_technique=\"T0855 - Unauthorized Command Message\",\n                ))\n\n        # Detection Rule 4: Broadcast write (unit ID 0)\n        if modbus[\"unit_id\"] == 0 and modbus[\"func_code\"] in MODBUS_WRITE_FUNCTIONS:\n            self.alerts.append(ModbusAlert(\n                severity=\"CRITICAL\",\n                alert_type=\"BROADCAST_WRITE\",\n                src_ip=src_ip, dst_ip=dst_ip,\n                unit_id=0,\n                func_code=modbus[\"func_code\"],\n                description=\"Broadcast write command (unit ID 0) affects ALL Modbus devices on segment\",\n                mitre_technique=\"T0855 - Unauthorized Command Message\",\n            ))\n\n        # Detection Rule 5: Out-of-range register access\n        if \"start_address\" in modbus and session_key in self.allowed_register_ranges:\n            addr = modbus[\"start_address\"]\n            qty = modbus.get(\"quantity\", 1)\n            in_range = any(\n                start \u003C= addr and addr + qty \u003C= end\n                for start, end in self.allowed_register_ranges[session_key]\n            )\n            if not in_range:\n                self.alerts.append(ModbusAlert(\n                    severity=\"HIGH\",\n                    alert_type=\"OUT_OF_RANGE_REGISTER\",\n                    src_ip=src_ip, dst_ip=dst_ip,\n                    unit_id=modbus[\"unit_id\"],\n                    func_code=modbus[\"func_code\"],\n                    description=f\"Register access {addr}-{addr+qty} outside baseline ranges\",\n                    mitre_technique=\"T0836 - Modify Parameter\",\n                ))\n\n        # Detection Rule 6: Diagnostic\u002Frestart commands\n        if modbus[\"func_code\"] in MODBUS_DIAGNOSTIC_FUNCTIONS:\n            self.alerts.append(ModbusAlert(\n                severity=\"HIGH\",\n                alert_type=\"DIAGNOSTIC_COMMAND\",\n                src_ip=src_ip, dst_ip=dst_ip,\n                unit_id=modbus[\"unit_id\"],\n                func_code=modbus[\"func_code\"],\n                description=f\"Diagnostic function code {modbus['func_code']} detected - potential DoS or reconnaissance\",\n                mitre_technique=\"T0814 - Denial of Service\",\n            ))\n\n    def print_report(self):\n        \"\"\"Print detection report.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(f\"MODBUS COMMAND INJECTION DETECTION REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Analysis Time: {datetime.now().isoformat()}\")\n        print(f\"Total Packets Analyzed: {self.packet_count}\")\n        print(f\"Modbus Packets: {self.modbus_count}\")\n        print(f\"Alerts Generated: {len(self.alerts)}\")\n\n        if self.alerts:\n            severity_counts = defaultdict(int)\n            for alert in self.alerts:\n                severity_counts[alert.severity] += 1\n\n            print(f\"\\nSeverity Distribution:\")\n            for sev in [\"CRITICAL\", \"HIGH\", \"MEDIUM\", \"LOW\"]:\n                if sev in severity_counts:\n                    print(f\"  {sev}: {severity_counts[sev]}\")\n\n            print(f\"\\nDetailed Alerts:\")\n            for alert in self.alerts:\n                print(f\"\\n  [{alert.severity}] {alert.alert_type}\")\n                print(f\"    Time: {alert.timestamp}\")\n                print(f\"    Source: {alert.src_ip} -> {alert.dst_ip}\")\n                print(f\"    Unit ID: {alert.unit_id}\")\n                print(f\"    Function: {alert.func_name} (FC {alert.func_code})\")\n                print(f\"    Detail: {alert.description}\")\n                if alert.mitre_technique:\n                    print(f\"    MITRE ATT&CK ICS: {alert.mitre_technique}\")\n\n    def start_live_monitoring(self, interface: str, duration: int = 0):\n        \"\"\"Start live Modbus traffic monitoring.\"\"\"\n        print(f\"[*] Starting Modbus monitoring on {interface}...\")\n        print(f\"[*] Press Ctrl+C to stop\")\n        try:\n            sniff(\n                iface=interface,\n                filter=\"tcp port 502\",\n                prn=self.analyze_packet,\n                timeout=duration if duration > 0 else None,\n            )\n        except KeyboardInterrupt:\n            pass\n        self.print_report()\n\n\nif __name__ == \"__main__\":\n    detector = ModbusInjectionDetector(\n        baseline_file=sys.argv[2] if len(sys.argv) > 2 else None\n    )\n\n    if len(sys.argv) >= 2:\n        if sys.argv[1].endswith(\".pcap\") or sys.argv[1].endswith(\".pcapng\"):\n            from scapy.all import rdpcap\n            print(f\"[*] Analyzing capture file: {sys.argv[1]}\")\n            packets = rdpcap(sys.argv[1])\n            for pkt in packets:\n                detector.analyze_packet(pkt)\n            detector.print_report()\n        else:\n            detector.start_live_monitoring(sys.argv[1])\n    else:\n        print(\"Usage:\")\n        print(\"  Live:    python modbus_detector.py \u003Cinterface> [baseline.json]\")\n        print(\"  Offline: python modbus_detector.py \u003Ccapture.pcap> [baseline.json]\")\n```\n\n### Step 2: Deploy Suricata Rules for Modbus Attack Detection\n\n```yaml\n# Suricata IDS Rules for Modbus Command Injection Detection\n# Reference: MITRE ATT&CK for ICS, FrostyGoop analysis\n\n# Unauthorized Modbus write from non-engineering workstation\nalert modbus !$MODBUS_AUTHORIZED_WRITERS any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Unauthorized write operation detected\";\n  modbus_func:write_single_coil;\n  flow:to_server,established;\n  classtype:attempted-admin;\n  sid:4000001; rev:1; priority:1;\n)\n\nalert modbus !$MODBUS_AUTHORIZED_WRITERS any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Unauthorized write multiple registers\";\n  modbus_func:write_multiple_registers;\n  flow:to_server,established;\n  classtype:attempted-admin;\n  sid:4000002; rev:1; priority:1;\n)\n\n# Modbus broadcast write affecting all slaves\nalert modbus any any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Broadcast write command (Unit ID 0)\";\n  modbus_unit_id:0;\n  flow:to_server,established;\n  classtype:attempted-admin;\n  sid:4000003; rev:1; priority:1;\n)\n\n# Excessive Modbus write rate (potential automated attack)\nalert modbus any any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Excessive write rate - possible automated attack\";\n  modbus_func:write_multiple_registers;\n  flow:to_server,established;\n  threshold:type threshold, track by_src, count 20, seconds 60;\n  classtype:attempted-admin;\n  sid:4000004; rev:1;\n)\n\n# Modbus diagnostics\u002Frestart command\nalert modbus any any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Diagnostics function code detected\";\n  modbus_func:diagnostics;\n  flow:to_server,established;\n  classtype:attempted-dos;\n  sid:4000005; rev:1;\n)\n\n# FrostyGoop-pattern: write to specific register ranges used for heating control\nalert modbus any any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Potential FrostyGoop - write to heating control registers\";\n  modbus_func:write_multiple_registers;\n  content:\"|00 10|\"; offset:8; depth:2;\n  flow:to_server,established;\n  classtype:attempted-admin;\n  sid:4000010; rev:1; priority:1;\n)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Modbus TCP | Industrial protocol operating on TCP port 502, lacking authentication or encryption, making it vulnerable to command injection |\n| Function Code | Single byte in Modbus PDU specifying the operation (read coils, write registers, diagnostics); monitoring for unauthorized function codes is key to detection |\n| MBAP Header | Modbus Application Protocol header in TCP variant containing transaction ID, protocol ID, length, and unit ID |\n| FrostyGoop | First known malware using Modbus TCP for real-world operational impact, disrupted Ukrainian district heating in 2024 |\n| Unit ID | Address of the target Modbus slave device; Unit ID 0 is a broadcast affecting all slaves |\n| Register Range | Specific memory addresses in the PLC; legitimate operations access known ranges; out-of-range access indicates reconnaissance or manipulation |\n\n## Common Scenarios\n\n### Scenario: FrostyGoop-Style Heating Control Attack\n\n**Context**: A building automation system uses Modbus TCP to control HVAC equipment. Monitoring detects unexpected write commands to heating control registers from an IP not associated with any authorized BMS controller.\n\n**Approach**:\n1. Verify the source IP against the authorized Modbus master list\n2. Check if any authorized maintenance or configuration change is in progress\n3. Capture full Modbus transaction including register addresses and values being written\n4. Compare written values against safe operating ranges for the heating equipment\n5. If unauthorized, immediately block the source IP at the industrial firewall\n6. Inspect the source device for compromise indicators (malware, unauthorized remote access)\n7. Verify current setpoints on all affected controllers against known-good values\n8. Restore safe setpoints if manipulation is confirmed\n\n**Pitfalls**: Modbus lacks authentication, so the source IP is the only identifier -- attackers can spoof IPs if ARP protections are not in place. Do not assume all writes are malicious; legitimate SCADA operations include writes. Always verify against the change management log before escalating.\n\n## Output Format\n\n```\nMODBUS INJECTION DETECTION REPORT\n====================================\nAnalysis Period: [start] to [end]\nMonitoring Point: [interface\u002FSPAN description]\n\nTRAFFIC SUMMARY:\n  Total Modbus Packets: [count]\n  Read Operations: [count]\n  Write Operations: [count]\n  Unauthorized Writes Detected: [count]\n\nALERTS:\n  [CRITICAL] Unauthorized write from [IP] to PLC [IP]\n    Function: Write Multiple Registers (FC 16)\n    Registers: [start]-[end]\n    MITRE: T0855 - Unauthorized Command Message\n\nBASELINE DEVIATIONS:\n  New Modbus masters: [list]\n  Unusual function codes: [list]\n  Out-of-range register access: [list]\n\nRECOMMENDED ACTIONS:\n  1. Verify source [IP] authorization status\n  2. Block unauthorized sources at industrial firewall\n  3. Validate PLC register values against known-good state\n```\n","# Detecting Modbus Command Injection Attacks\n\n## When to Use\n\n- When deploying intrusion detection for environments using Modbus TCP (port 502) or Modbus RTU\n- When investigating suspected unauthorized modifications to PLC registers or coils\n- When building detection analytics for OT SOC monitoring Modbus-heavy environments\n- When responding to FrostyGoop-style attacks that leverage Modbus TCP for operational impact\n- When performing baseline validation after a suspected compromise of a Modbus master\n\n**Do not use** for detecting attacks on non-Modbus protocols (see detecting-dnp3-protocol-anomalies for DNP3), for general IT network intrusion detection, or for Modbus device configuration (see performing-ot-vulnerability-scanning-safely).\n\n## Prerequisites\n\n- Network SPAN\u002FTAP on the segment carrying Modbus TCP traffic (typically port 502)\n- Baseline of normal Modbus communication patterns (masters, slaves, function codes, register ranges, polling intervals)\n- Suricata, Zeek, or commercial OT IDS deployed with Modbus protocol parsers enabled\n- Understanding of Modbus function codes used in the environment (read vs write operations)\n- Access to PLC programming documentation to validate expected register ranges\n\n## Workflow\n\n### Step 1: Build Modbus Communication Baseline\n\nCapture and analyze normal Modbus traffic to establish what constitutes legitimate communication patterns.\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"Modbus Command Injection Detector.\n\nMonitors Modbus TCP traffic for unauthorized write operations, anomalous\nfunction codes, and deviations from established communication baselines.\nDetects attacks like FrostyGoop that use Modbus TCP for operational impact.\n\"\"\"\n\nimport json\nimport struct\nimport sys\nimport time\nfrom collections import defaultdict\nfrom datetime import datetime\nfrom typing import Dict, List, Optional, Set, Tuple\n\ntry:\n    from scapy.all import sniff, IP, TCP\nexcept ImportError:\n    print(\"Install scapy: pip install scapy\")\n    sys.exit(1)\n\n\n# Modbus function code definitions\nMODBUS_READ_FUNCTIONS = {1, 2, 3, 4}\nMODBUS_WRITE_FUNCTIONS = {5, 6, 15, 16}\nMODBUS_DIAGNOSTIC_FUNCTIONS = {8, 17, 43}\n\nMODBUS_FUNC_NAMES = {\n    1: \"Read Coils\", 2: \"Read Discrete Inputs\",\n    3: \"Read Holding Registers\", 4: \"Read Input Registers\",\n    5: \"Write Single Coil\", 6: \"Write Single Register\",\n    8: \"Diagnostics\", 15: \"Write Multiple Coils\",\n    16: \"Write Multiple Registers\", 17: \"Report Slave ID\",\n    22: \"Mask Write Register\", 23: \"Read\u002FWrite Multiple Registers\",\n    43: \"Encapsulated Interface Transport\",\n}\n\n\nclass ModbusAlert:\n    \"\"\"Represents a detected Modbus anomaly.\"\"\"\n\n    def __init__(self, severity: str, alert_type: str, src_ip: str,\n                 dst_ip: str, unit_id: int, func_code: int,\n                 description: str, mitre_technique: str = \"\"):\n        self.timestamp = datetime.now().isoformat()\n        self.severity = severity\n        self.alert_type = alert_type\n        self.src_ip = src_ip\n        self.dst_ip = dst_ip\n        self.unit_id = unit_id\n        self.func_code = func_code\n        self.func_name = MODBUS_FUNC_NAMES.get(func_code, f\"Unknown FC {func_code}\")\n        self.description = description\n        self.mitre_technique = mitre_technique\n\n    def __str__(self):\n        return (\n            f\"[{self.severity}] {self.alert_type} | {self.src_ip} -> {self.dst_ip} \"\n            f\"| Unit {self.unit_id} | {self.func_name} | {self.description}\"\n        )\n\n\nclass ModbusInjectionDetector:\n    \"\"\"Detects Modbus command injection attacks.\"\"\"\n\n    def __init__(self, baseline_file: Optional[str] = None):\n        self.alerts: List[ModbusAlert] = []\n        self.packet_count = 0\n        self.modbus_count = 0\n\n        # Baseline data\n        self.authorized_masters: Set[str] = set()\n        self.authorized_pairs: Set[Tuple[str, str]] = set()\n        self.allowed_write_sources: Set[str] = set()\n        self.allowed_function_codes: Dict[str, Set[int]] = defaultdict(set)\n        self.allowed_register_ranges: Dict[str, List[Tuple[int, int]]] = defaultdict(list)\n        self.polling_intervals: Dict[str, float] = {}\n        self.last_seen: Dict[str, float] = {}\n\n        # Counters for rate detection\n        self.write_counts: Dict[str, List[float]] = defaultdict(list)\n\n        if baseline_file:\n            self.load_baseline(baseline_file)\n\n    def load_baseline(self, filepath: str):\n        \"\"\"Load established Modbus communication baseline.\"\"\"\n        with open(filepath, \"r\") as f:\n            baseline = json.load(f)\n\n        for session_key, data in baseline.get(\"modbus_baselines\", {}).items():\n            src, dst = session_key.split(\"->\")\n            self.authorized_pairs.add((src.strip(), dst.strip()))\n            self.authorized_masters.add(src.strip())\n\n            fc_set = set(data.get(\"allowed_function_codes\", []))\n            self.allowed_function_codes[session_key] = fc_set\n\n            if fc_set & MODBUS_WRITE_FUNCTIONS:\n                self.allowed_write_sources.add(src.strip())\n\n            for reg_range in data.get(\"register_ranges\", []):\n                self.allowed_register_ranges[session_key].append(\n                    (reg_range[\"start\"], reg_range[\"end\"])\n                )\n\n            if data.get(\"polling_interval_avg_sec\"):\n                self.polling_intervals[session_key] = data[\"polling_interval_avg_sec\"]\n\n        print(f\"[*] Baseline loaded: {len(self.authorized_pairs)} authorized pairs, \"\n              f\"{len(self.allowed_write_sources)} authorized write sources\")\n\n    def parse_modbus_mbap(self, payload: bytes) -> Optional[dict]:\n        \"\"\"Parse Modbus TCP MBAP header and PDU.\"\"\"\n        if len(payload) \u003C 8:\n            return None\n\n        transaction_id = struct.unpack(\">H\", payload[0:2])[0]\n        protocol_id = struct.unpack(\">H\", payload[2:4])[0]\n        length = struct.unpack(\">H\", payload[4:6])[0]\n        unit_id = payload[6]\n        func_code = payload[7]\n\n        if protocol_id != 0:  # Not Modbus\n            return None\n\n        result = {\n            \"transaction_id\": transaction_id,\n            \"protocol_id\": protocol_id,\n            \"length\": length,\n            \"unit_id\": unit_id,\n            \"func_code\": func_code,\n        }\n\n        # Parse register address and count for read\u002Fwrite operations\n        if len(payload) >= 12 and func_code in (1, 2, 3, 4, 5, 6, 15, 16):\n            result[\"start_address\"] = struct.unpack(\">H\", payload[8:10])[0]\n            result[\"quantity\"] = struct.unpack(\">H\", payload[10:12])[0]\n\n        return result\n\n    def analyze_packet(self, pkt):\n        \"\"\"Analyze a network packet for Modbus command injection.\"\"\"\n        self.packet_count += 1\n\n        if not pkt.haslayer(IP) or not pkt.haslayer(TCP):\n            return\n\n        tcp = pkt[TCP]\n        if tcp.dport != 502 and tcp.sport != 502:\n            return\n\n        payload = bytes(tcp.payload)\n        if not payload:\n            return\n\n        modbus = self.parse_modbus_mbap(payload)\n        if not modbus:\n            return\n\n        self.modbus_count += 1\n        src_ip = pkt[IP].src\n        dst_ip = pkt[IP].dst\n        session_key = f\"{src_ip}->{dst_ip}\"\n        now = time.time()\n\n        # Detection Rule 1: Unauthorized Modbus master\n        if self.authorized_masters and src_ip not in self.authorized_masters:\n            if tcp.dport == 502:\n                self.alerts.append(ModbusAlert(\n                    severity=\"CRITICAL\",\n                    alert_type=\"UNAUTHORIZED_MASTER\",\n                    src_ip=src_ip, dst_ip=dst_ip,\n                    unit_id=modbus[\"unit_id\"],\n                    func_code=modbus[\"func_code\"],\n                    description=f\"Unauthorized device {src_ip} sending Modbus commands to {dst_ip}\",\n                    mitre_technique=\"T0843 - Program Download\",\n                ))\n\n        # Detection Rule 2: Unauthorized write operation\n        if modbus[\"func_code\"] in MODBUS_WRITE_FUNCTIONS:\n            if self.allowed_write_sources and src_ip not in self.allowed_write_sources:\n                self.alerts.append(ModbusAlert(\n                    severity=\"CRITICAL\",\n                    alert_type=\"UNAUTHORIZED_WRITE\",\n                    src_ip=src_ip, dst_ip=dst_ip,\n                    unit_id=modbus[\"unit_id\"],\n                    func_code=modbus[\"func_code\"],\n                    description=f\"Write command from non-authorized source {src_ip}\",\n                    mitre_technique=\"T0855 - Unauthorized Command Message\",\n                ))\n\n            # Track write frequency for rate anomaly detection\n            self.write_counts[src_ip].append(now)\n            recent_writes = [t for t in self.write_counts[src_ip] if now - t \u003C 60]\n            self.write_counts[src_ip] = recent_writes\n            if len(recent_writes) > 20:\n                self.alerts.append(ModbusAlert(\n                    severity=\"HIGH\",\n                    alert_type=\"WRITE_FLOOD\",\n                    src_ip=src_ip, dst_ip=dst_ip,\n                    unit_id=modbus[\"unit_id\"],\n                    func_code=modbus[\"func_code\"],\n                    description=f\"Excessive write rate: {len(recent_writes)} writes in 60s from {src_ip}\",\n                    mitre_technique=\"T0836 - Modify Parameter\",\n                ))\n\n        # Detection Rule 3: Anomalous function code\n        if session_key in self.allowed_function_codes:\n            if modbus[\"func_code\"] not in self.allowed_function_codes[session_key]:\n                self.alerts.append(ModbusAlert(\n                    severity=\"HIGH\",\n                    alert_type=\"ANOMALOUS_FUNCTION_CODE\",\n                    src_ip=src_ip, dst_ip=dst_ip,\n                    unit_id=modbus[\"unit_id\"],\n                    func_code=modbus[\"func_code\"],\n                    description=(\n                        f\"Function code {modbus['func_code']} ({MODBUS_FUNC_NAMES.get(modbus['func_code'], 'Unknown')}) \"\n                        f\"not in baseline for {session_key}\"\n                    ),\n                    mitre_technique=\"T0855 - Unauthorized Command Message\",\n                ))\n\n        # Detection Rule 4: Broadcast write (unit ID 0)\n        if modbus[\"unit_id\"] == 0 and modbus[\"func_code\"] in MODBUS_WRITE_FUNCTIONS:\n            self.alerts.append(ModbusAlert(\n                severity=\"CRITICAL\",\n                alert_type=\"BROADCAST_WRITE\",\n                src_ip=src_ip, dst_ip=dst_ip,\n                unit_id=0,\n                func_code=modbus[\"func_code\"],\n                description=\"Broadcast write command (unit ID 0) affects ALL Modbus devices on segment\",\n                mitre_technique=\"T0855 - Unauthorized Command Message\",\n            ))\n\n        # Detection Rule 5: Out-of-range register access\n        if \"start_address\" in modbus and session_key in self.allowed_register_ranges:\n            addr = modbus[\"start_address\"]\n            qty = modbus.get(\"quantity\", 1)\n            in_range = any(\n                start \u003C= addr and addr + qty \u003C= end\n                for start, end in self.allowed_register_ranges[session_key]\n            )\n            if not in_range:\n                self.alerts.append(ModbusAlert(\n                    severity=\"HIGH\",\n                    alert_type=\"OUT_OF_RANGE_REGISTER\",\n                    src_ip=src_ip, dst_ip=dst_ip,\n                    unit_id=modbus[\"unit_id\"],\n                    func_code=modbus[\"func_code\"],\n                    description=f\"Register access {addr}-{addr+qty} outside baseline ranges\",\n                    mitre_technique=\"T0836 - Modify Parameter\",\n                ))\n\n        # Detection Rule 6: Diagnostic\u002Frestart commands\n        if modbus[\"func_code\"] in MODBUS_DIAGNOSTIC_FUNCTIONS:\n            self.alerts.append(ModbusAlert(\n                severity=\"HIGH\",\n                alert_type=\"DIAGNOSTIC_COMMAND\",\n                src_ip=src_ip, dst_ip=dst_ip,\n                unit_id=modbus[\"unit_id\"],\n                func_code=modbus[\"func_code\"],\n                description=f\"Diagnostic function code {modbus['func_code']} detected - potential DoS or reconnaissance\",\n                mitre_technique=\"T0814 - Denial of Service\",\n            ))\n\n    def print_report(self):\n        \"\"\"Print detection report.\"\"\"\n        print(f\"\\n{'='*70}\")\n        print(f\"MODBUS COMMAND INJECTION DETECTION REPORT\")\n        print(f\"{'='*70}\")\n        print(f\"Analysis Time: {datetime.now().isoformat()}\")\n        print(f\"Total Packets Analyzed: {self.packet_count}\")\n        print(f\"Modbus Packets: {self.modbus_count}\")\n        print(f\"Alerts Generated: {len(self.alerts)}\")\n\n        if self.alerts:\n            severity_counts = defaultdict(int)\n            for alert in self.alerts:\n                severity_counts[alert.severity] += 1\n\n            print(f\"\\nSeverity Distribution:\")\n            for sev in [\"CRITICAL\", \"HIGH\", \"MEDIUM\", \"LOW\"]:\n                if sev in severity_counts:\n                    print(f\"  {sev}: {severity_counts[sev]}\")\n\n            print(f\"\\nDetailed Alerts:\")\n            for alert in self.alerts:\n                print(f\"\\n  [{alert.severity}] {alert.alert_type}\")\n                print(f\"    Time: {alert.timestamp}\")\n                print(f\"    Source: {alert.src_ip} -> {alert.dst_ip}\")\n                print(f\"    Unit ID: {alert.unit_id}\")\n                print(f\"    Function: {alert.func_name} (FC {alert.func_code})\")\n                print(f\"    Detail: {alert.description}\")\n                if alert.mitre_technique:\n                    print(f\"    MITRE ATT&CK ICS: {alert.mitre_technique}\")\n\n    def start_live_monitoring(self, interface: str, duration: int = 0):\n        \"\"\"Start live Modbus traffic monitoring.\"\"\"\n        print(f\"[*] Starting Modbus monitoring on {interface}...\")\n        print(f\"[*] Press Ctrl+C to stop\")\n        try:\n            sniff(\n                iface=interface,\n                filter=\"tcp port 502\",\n                prn=self.analyze_packet,\n                timeout=duration if duration > 0 else None,\n            )\n        except KeyboardInterrupt:\n            pass\n        self.print_report()\n\n\nif __name__ == \"__main__\":\n    detector = ModbusInjectionDetector(\n        baseline_file=sys.argv[2] if len(sys.argv) > 2 else None\n    )\n\n    if len(sys.argv) >= 2:\n        if sys.argv[1].endswith(\".pcap\") or sys.argv[1].endswith(\".pcapng\"):\n            from scapy.all import rdpcap\n            print(f\"[*] Analyzing capture file: {sys.argv[1]}\")\n            packets = rdpcap(sys.argv[1])\n            for pkt in packets:\n                detector.analyze_packet(pkt)\n            detector.print_report()\n        else:\n            detector.start_live_monitoring(sys.argv[1])\n    else:\n        print(\"Usage:\")\n        print(\"  Live:    python modbus_detector.py \u003Cinterface> [baseline.json]\")\n        print(\"  Offline: python modbus_detector.py \u003Ccapture.pcap> [baseline.json]\")\n```\n\n### Step 2: Deploy Suricata Rules for Modbus Attack Detection\n\n```yaml\n# Suricata IDS Rules for Modbus Command Injection Detection\n# Reference: MITRE ATT&CK for ICS, FrostyGoop analysis\n\n# Unauthorized Modbus write from non-engineering workstation\nalert modbus !$MODBUS_AUTHORIZED_WRITERS any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Unauthorized write operation detected\";\n  modbus_func:write_single_coil;\n  flow:to_server,established;\n  classtype:attempted-admin;\n  sid:4000001; rev:1; priority:1;\n)\n\nalert modbus !$MODBUS_AUTHORIZED_WRITERS any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Unauthorized write multiple registers\";\n  modbus_func:write_multiple_registers;\n  flow:to_server,established;\n  classtype:attempted-admin;\n  sid:4000002; rev:1; priority:1;\n)\n\n# Modbus broadcast write affecting all slaves\nalert modbus any any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Broadcast write command (Unit ID 0)\";\n  modbus_unit_id:0;\n  flow:to_server,established;\n  classtype:attempted-admin;\n  sid:4000003; rev:1; priority:1;\n)\n\n# Excessive Modbus write rate (potential automated attack)\nalert modbus any any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Excessive write rate - possible automated attack\";\n  modbus_func:write_multiple_registers;\n  flow:to_server,established;\n  threshold:type threshold, track by_src, count 20, seconds 60;\n  classtype:attempted-admin;\n  sid:4000004; rev:1;\n)\n\n# Modbus diagnostics\u002Frestart command\nalert modbus any any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Diagnostics function code detected\";\n  modbus_func:diagnostics;\n  flow:to_server,established;\n  classtype:attempted-dos;\n  sid:4000005; rev:1;\n)\n\n# FrostyGoop-pattern: write to specific register ranges used for heating control\nalert modbus any any -> $OT_PLC_SUBNET 502 (\n  msg:\"MODBUS-INJECT Potential FrostyGoop - write to heating control registers\";\n  modbus_func:write_multiple_registers;\n  content:\"|00 10|\"; offset:8; depth:2;\n  flow:to_server,established;\n  classtype:attempted-admin;\n  sid:4000010; rev:1; priority:1;\n)\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| Modbus TCP | Industrial protocol operating on TCP port 502, lacking authentication or encryption, making it vulnerable to command injection |\n| Function Code | Single byte in Modbus PDU specifying the operation (read coils, write registers, diagnostics); monitoring for unauthorized function codes is key to detection |\n| MBAP Header | Modbus Application Protocol header in TCP variant containing transaction ID, protocol ID, length, and unit ID |\n| FrostyGoop | First known malware using Modbus TCP for real-world operational impact, disrupted Ukrainian district heating in 2024 |\n| Unit ID | Address of the target Modbus slave device; Unit ID 0 is a broadcast affecting all slaves |\n| Register Range | Specific memory addresses in the PLC; legitimate operations access known ranges; out-of-range access indicates reconnaissance or manipulation |\n\n## Common Scenarios\n\n### Scenario: FrostyGoop-Style Heating Control Attack\n\n**Context**: A building automation system uses Modbus TCP to control HVAC equipment. Monitoring detects unexpected write commands to heating control registers from an IP not associated with any authorized BMS controller.\n\n**Approach**:\n1. Verify the source IP against the authorized Modbus master list\n2. Check if any authorized maintenance or configuration change is in progress\n3. Capture full Modbus transaction including register addresses and values being written\n4. Compare written values against safe operating ranges for the heating equipment\n5. If unauthorized, immediately block the source IP at the industrial firewall\n6. Inspect the source device for compromise indicators (malware, unauthorized remote access)\n7. Verify current setpoints on all affected controllers against known-good values\n8. Restore safe setpoints if manipulation is confirmed\n\n**Pitfalls**: Modbus lacks authentication, so the source IP is the only identifier -- attackers can spoof IPs if ARP protections are not in place. Do not assume all writes are malicious; legitimate SCADA operations include writes. Always verify against the change management log before escalating.\n\n## Output Format\n\n```\nMODBUS INJECTION DETECTION REPORT\n====================================\nAnalysis Period: [start] to [end]\nMonitoring Point: [interface\u002FSPAN description]\n\nTRAFFIC SUMMARY:\n  Total Modbus Packets: [count]\n  Read Operations: [count]\n  Write Operations: [count]\n  Unauthorized Writes Detected: [count]\n\nALERTS:\n  [CRITICAL] Unauthorized write from [IP] to PLC [IP]\n    Function: Write Multiple Registers (FC 16)\n    Registers: [start]-[end]\n    MITRE: T0855 - Unauthorized Command Message\n\nBASELINE DEVIATIONS:\n  New Modbus masters: [list]\n  Unusual function codes: [list]\n  Out-of-range register access: [list]\n\nRECOMMENDED ACTIONS:\n  1. Verify source [IP] authorization status\n  2. Block unauthorized sources at industrial firewall\n  3. Validate PLC register values against known-good state\n```\n",{"name":5,"tags":49,"author":54,"domain":30,"license":15,"version":55,"nist_csf":56,"subdomain":61,"description":62,"mitre_attack":63},[50,51,25,52,40,38,53,39],"ot-security","ics","command-injection","scada","mahipal","1.0",[57,58,59,60],"PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02","ot-ics-security","Detect command injection attacks against Modbus TCP\u002FRTU protocol in ICS environments by monitoring for unauthorized write operations, anomalous function codes, malformed frames, and deviations from established communication baselines using ICS-aware IDS and protocol deep packet inspection.\n",[64,65,66,67,68],"T1078","T1190","T1059","T1055","T0816","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fdetecting-modbus-command-injection-attacks","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":78,"prompt":88,"zipAvailable":89},[79,82,85],{"tool":80,"command":81},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill detecting-modbus-command-injection-attacks",{"tool":83,"command":84},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill detecting-modbus-command-injection-attacks",{"tool":86,"command":87},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill detecting-modbus-command-injection-attacks","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-modbus-command-injection-attacks\u002FSKILL.md",true,[91,96,102],{"path":92,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-modbus-command-injection-attacks\u002FLICENSE",{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"references\u002Fapi-reference.md","REFERENCE","参考文档",1636,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-modbus-command-injection-attacks\u002Freferences\u002Fapi-reference.md",{"path":103,"resourceType":104,"resourceTypeDesc":105,"sizeBytes":106,"sourceHtmlUrl":107},"scripts\u002Fagent.py","SCRIPT","脚本",5239,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdetecting-modbus-command-injection-attacks\u002Fscripts\u002Fagent.py",[109,149,158,167,189,214],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":114,"categories":115,"keywords":130,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[116,119,122,125],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":123,"categoryName":124,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[111,131,132,133,134,135,136,137,138,139,140,141,142,34,143,144,145,146,147,148],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","edit","html","images","files","youtube","with",{"skillNo":150,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":157,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[153,154,155,156],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":123,"categoryName":124,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},[111,131,132,133,134,135,136,137,138,139,140,141,142,34,143,144,145,146,147,148],{"skillNo":159,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":166,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[162,163,164,165],{"categoryNo":117,"categoryName":118,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":120,"categoryName":121,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":123,"categoryName":124,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":126,"categoryName":127,"taxonomyType":128,"taxonomyTypeDesc":129},[111,131,132,133,134,135,136,137,138,139,140,141,142,34,143,144,145,146,147,148],{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[174,175,176,177,178,179,180,181,182,183,184,185,186,187,188],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[195],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[197,198,199,200,201,202,36,203,204,205,206,142,34,207,208,209,210,211,212,213],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":230,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[220,223,226,227],{"categoryNo":221,"categoryName":222,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":224,"categoryName":225,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":228,"categoryName":229,"taxonomyType":128,"taxonomyTypeDesc":129},"01JBSEEDCAT000000000000036","内容创作者",[231,232,233,234,235,236,237,238,139,239,142,34,143,240,241,242,243,244,188,245],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]