[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71DDP5PK4RGA3V4AE22EMG5":3,"skill-same:01M71DDP5PK4RGA3V4AE22EMG5":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":24,"linkOnly":25,"markdownContent":26,"markdownBody":27,"frontMatter":28,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":14,"repositoryHtmlUrl":32,"repositoryHomepageUrl":6,"ownerHtmlUrl":33,"ownerBlogUrl":6,"ownerDescription":34,"updatedAt":35,"install":36,"resources":49},"01M71DDP5PK4RGA3V4AE22EMG5","ics-protocols-s7comm",null,"Ics Ics Protocols S7Comm.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-s7comm\u002FSKILL.md",[],[19,20,21,22,23],"protocols","ics","s7comm","ics protocols s7comm","cybersecurity","2026-11-10 10:12:30",false,"---\nname: ics-protocols-s7comm\ndescription: \"Ics Ics Protocols S7Comm.\"\ndomain: cybersecurity\n---\n\n|\n| S7comm | Siemens proprietary protocol for communication with SIMATIC S7 PLCs over TCP port 102, layered on COTP\u002FTPKT |\n| S7CommPlus | Enhanced version of S7comm used by S7-1200\u002F1500 with integrity protection mechanisms |\n| ROSCTR | Remote Operating Service Control field in S7comm header indicating PDU type (Job, Ack, Ack_Data, Userdata) |\n| TIA Portal | Totally Integrated Automation Portal -- Siemens engineering software for programming S7 PLCs |\n| CPU Stop (0x29) | S7comm function that halts PLC program execution, a critical denial-of-service operation |\n| Program Download (0x1A) | S7comm function initiating transfer of new control logic to a PLC, representing the highest risk operation |\n\n## Common Scenarios\n\n### Scenario: Unauthorized PLC Program Modification\n\n**Context**: A Dragos sensor alerts on S7comm program download traffic from an IP address that is not the authorized TIA Portal engineering workstation.\n\n**Approach**:\n1. Capture the complete S7comm session for forensic analysis\n2. Identify the source host and determine if it is compromised or rogue\n3. Compare the current PLC program against the last known-good backup\n4. Check if the PLC CPU mode was changed (RUN to STOP to PROGRAM)\n5. If the program was modified, restore from verified backup\n6. Investigate the attack chain -- how did the attacker reach the S7comm network segment\n7. Implement S7comm access protection (know-how protection, access passwords) on all PLCs\n\n**Pitfalls**: S7-300\u002F400 PLCs have no cryptographic integrity protection -- any device that can reach TCP port 102 can send commands. Do not rely solely on PLC passwords as they are transmitted in cleartext in S7comm (not S7CommPlus). Network segmentation is the primary defense.\n\n## Output Format\n\n```\nS7COMM SECURITY ANALYSIS REPORT\n===================================\nDate: YYYY-MM-DD\nScope: [Network segments analyzed]\n\nSESSION INVENTORY:\n  Engineering stations: [count and IPs]\n  PLCs communicating: [count and IPs]\n  Unauthorized sources: [count]\n\nCRITICAL FINDINGS:\n  CPU Stop commands: [count]\n  Program downloads: [count from unauthorized sources]\n  Replay attack potential: [assessment]\n\nVULNERABILITY ASSESSMENT:\n  S7-300\u002F400 (no integrity): [count of affected PLCs]\n  S7-1200\u002F1500 (S7CommPlus): [firmware assessment]\n  Known CVEs applicable: [list]\n\nRECOMMENDATIONS:\n  1. [Highest priority remediation]\n  2. [Network segmentation improvement]\n  3. [Monitoring enhancement]\n```\n","|\n| S7comm | Siemens proprietary protocol for communication with SIMATIC S7 PLCs over TCP port 102, layered on COTP\u002FTPKT |\n| S7CommPlus | Enhanced version of S7comm used by S7-1200\u002F1500 with integrity protection mechanisms |\n| ROSCTR | Remote Operating Service Control field in S7comm header indicating PDU type (Job, Ack, Ack_Data, Userdata) |\n| TIA Portal | Totally Integrated Automation Portal -- Siemens engineering software for programming S7 PLCs |\n| CPU Stop (0x29) | S7comm function that halts PLC program execution, a critical denial-of-service operation |\n| Program Download (0x1A) | S7comm function initiating transfer of new control logic to a PLC, representing the highest risk operation |\n\n## Common Scenarios\n\n### Scenario: Unauthorized PLC Program Modification\n\n**Context**: A Dragos sensor alerts on S7comm program download traffic from an IP address that is not the authorized TIA Portal engineering workstation.\n\n**Approach**:\n1. Capture the complete S7comm session for forensic analysis\n2. Identify the source host and determine if it is compromised or rogue\n3. Compare the current PLC program against the last known-good backup\n4. Check if the PLC CPU mode was changed (RUN to STOP to PROGRAM)\n5. If the program was modified, restore from verified backup\n6. Investigate the attack chain -- how did the attacker reach the S7comm network segment\n7. Implement S7comm access protection (know-how protection, access passwords) on all PLCs\n\n**Pitfalls**: S7-300\u002F400 PLCs have no cryptographic integrity protection -- any device that can reach TCP port 102 can send commands. Do not rely solely on PLC passwords as they are transmitted in cleartext in S7comm (not S7CommPlus). Network segmentation is the primary defense.\n\n## Output Format\n\n```\nS7COMM SECURITY ANALYSIS REPORT\n===================================\nDate: YYYY-MM-DD\nScope: [Network segments analyzed]\n\nSESSION INVENTORY:\n  Engineering stations: [count and IPs]\n  PLCs communicating: [count and IPs]\n  Unauthorized sources: [count]\n\nCRITICAL FINDINGS:\n  CPU Stop commands: [count]\n  Program downloads: [count from unauthorized sources]\n  Replay attack potential: [assessment]\n\nVULNERABILITY ASSESSMENT:\n  S7-300\u002F400 (no integrity): [count of affected PLCs]\n  S7-1200\u002F1500 (S7CommPlus): [firmware assessment]\n  Known CVEs applicable: [list]\n\nRECOMMENDATIONS:\n  1. [Highest priority remediation]\n  2. [Network segmentation improvement]\n  3. [Monitoring enhancement]\n```\n",{"name":5,"domain":23,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fics-protocols-s7comm","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill ics-protocols-s7comm",{"tool":42,"command":43},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill ics-protocols-s7comm",{"tool":45,"command":46},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill ics-protocols-s7comm","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-s7comm\u002FSKILL.md",true,[50,56,60,64,70],{"path":51,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":54,"sourceHtmlUrl":55},"index.json","REFERENCE","参考文档",1080,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-s7comm\u002Findex.json",{"path":57,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":58,"sourceHtmlUrl":59},"references\u002Fapi-reference.md",2406,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-s7comm\u002Freferences\u002Fapi-reference.md",{"path":61,"resourceType":52,"resourceTypeDesc":53,"sizeBytes":62,"sourceHtmlUrl":63},"references\u002Findex.json",84,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-s7comm\u002Freferences\u002Findex.json",{"path":65,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":68,"sourceHtmlUrl":69},"scripts\u002Fagent.py","SCRIPT","脚本",6280,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-s7comm\u002Fscripts\u002Fagent.py",{"path":71,"resourceType":66,"resourceTypeDesc":67,"sizeBytes":62,"sourceHtmlUrl":72},"scripts\u002Findex.json","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fics-protocols-s7comm\u002Fscripts\u002Findex.json",[74,99,122,144,166,182],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":24},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,23,98],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":100,"name":101,"nameZh":6,"description":102,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":103,"categories":104,"keywords":105,"publishedAt":24},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[106,81,107,84,108,109,110,23,111,112,113,114,115,116,86,117,118,119,120,121],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":24},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[129,130,131,132,133,134,23,111,135,112,136,137,86,119,138,139,140,141,142,143],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":150,"publishedAt":24},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[82,151,152,153,154,155,156,87,157,23,98,158,159,160,161,162,163,164,165,86],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":24},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[173,174,82,175,153,155,176,87,177,157,23,98,112,178,179,180,181,165,86,88],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":24},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[189,82,153,190,176,87,191,192,23,98,193,194,195,196,197,198,86,88,199,200],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]