Unauthorized PLC changes (Microsoft Defender for IoT)

Status: available
Severity: medium
Time window: 1h
Source: github.com/Azure/Azure-Sentinel

'This alert leverages Defender for IoT to detect unauthorized changes to PLC ladder logic code indicating new functionality in the PLC, improper configuration of an application, or malicious activity on the network.'

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T0839` Module Firmware
Impair Process Control	`T0839` Module Firmware

Rule body kusto

id: c2fb27c7-5f67-49c4-aaf3-d82934234a69
name: Unauthorized PLC changes (Microsoft Defender for IoT)
description: |
  'This alert leverages Defender for IoT to detect unauthorized changes to PLC ladder logic code indicating new functionality in the PLC, improper configuration of an application, or malicious activity on the network.'
severity: Medium
status: Available
requiredDataConnectors:
  - connectorId: IoT
    dataTypes:
      - SecurityAlert (ASC for IoT)
queryFrequency: 1h
queryPeriod: 1h
triggerOperator: gt
triggerThreshold: 0
tactics:
  - Persistence
relevantTechniques:
  - T0839
query: |
  let alertList = dynamic(["Unpermitted Usage of Internal Indication (IIN)", "Modbus Address Range Violation", "Function Code Raised Unauthorized Exception", "Unauthorized Access to Siemens S7 Data Block", "Unauthorized Access to Wonderware Tag", "Unauthorized MMS Program Access", "GOOSE Message Type Settings", "Sampled Values Message Type Settings", "Foxboro I/A Unauthorized Operation", "New Activity Detected - CIP Class", "New Activity Detected - CIP Class Service", "New Activity Detected - CIP PCCC Command", "New Activity Detected - CIP Symbol", "New Activity Detected - EtherNet/IP I/O Connection", "New Activity Detected - EtherNet/IP Protocol Command", "New Activity Detected - GSM Message Code", "New Activity Detected - LonTalk Command Codes", "New Activity Detected - LonTalk Network Variable", "New Activity Detected - Ovation Data Request", "New Activity Detected - Read/Write Command (AMS Index Group)", "New Activity Detected - Read/Write Command (AMS Index Offset)", "New Activity Detected - Unauthorized DeltaV Message Type", "New Activity Detected - Unauthorized DeltaV ROC Operation", "New Activity Detected - Using AMS Protocol Command", "New Activity Detected - Using Siemens SICAM Command", "New Activity Detected - Using Suitelink Protocol command", "New Activity Detected - Using Suitelink Protocol sessions", "New Activity Detected - Using Yokogawa VNetIP Command", "Omron FINS Unauthorized Command", "Toshiba Computer Link Unauthorized Command", "Unauthorized ABB Totalflow File Operation", "Unauthorized ABB Totalflow Register Operation", "Unauthorized Access to Siemens S7 Plus Object", "Unauthorized BACNet Object Access", "Unauthorized BACNet Route", "Unauthorized Emerson ROC Operation", "Unauthorized GE SRTP File Access", "Unauthorized GE SRTP Protocol Command", "Unauthorized GE SRTP System Memory Operation", "Unauthorized Mitsubishi MELSEC Command", "Unauthorized MMS Service", "Unauthorized OPC UA Activity", "Unauthorized OPC UA Request/Response", "Unauthorized Profinet Frame Type", "Unauthorized SAIA S-Bus Command", "Unauthorized Siemens S7 Execution of Control Function", "Unauthorized Siemens S7 Execution of User Defined Function", "Unauthorized Siemens S7 Plus Block Access", "Unauthorized Siemens S7 Plus Operation", "Unauthorized SNMP Operation", "Unpermitted Modbus Schneider Electric Extension", "Unpermitted Usage of ASDU Types", "Unpermitted Usage of DNP3 Function Code", "Unpermitted Usage of Modbus Function Code", "Unauthorized Operation was detected by a User Defined Rule", "Unauthorized PLC Configuration Read", "Unauthorized PLC Programming", "Unauthorized PLC Configuration Write", "Unauthorized PLC Program Upload"]);
  SecurityAlert
  | where ProviderName == "IoTSecurity"
  | where AlertName has_any (alertList) 
    or ExtendedProperties has_any ("Illegal Beckhoff AMS Command", "Beckhoff AMS Command Failure")
  | extend ExtendedProperties = parse_json(ExtendedProperties)
  | where tostring(ExtendedProperties.isNew) == "True"
  | extend DeviceId = tostring(ExtendedProperties.DeviceId), 
           SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
           DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
           RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
           Protocol = tostring(ExtendedProperties.Protocol), 
           AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)
  | project
    TimeGenerated,
    DeviceId,
    ProductName,
    ProductComponentName,
    AlertSeverity,
    AlertName,
    Description,
    Protocol,
    SourceDeviceAddress,
    DestDeviceAddress,
    RemediationSteps,
    Tactics,
    Entities,
    VendorOriginalId,
    AlertLink,
    AlertManagementUri,
    Techniques
entityMappings:
sentinelEntitiesMappings:
  - columnName: Entities
eventGroupingSettings:
  aggregationKind: AlertPerResult
customDetails:
  Sensor: DeviceId
  Protocol: Protocol
  VendorOriginalId: VendorOriginalId
  AlertManagementUri: AlertManagementUri
alertDetailsOverride:
  alertDisplayNameFormat: (MDIoT) {{AlertName}}
  alertDescriptionFormat: (MDIoT) {{Description}}
  alertTacticsColumnName: Tactics
  alertSeverityColumnName: AlertSeverity
  alertDynamicProperties: 
    - alertProperty: ProductName
      value: ProductName
    - alertProperty: RemediationSteps
      value: RemediationSteps
    - alertProperty: Techniques
      value: Techniques
    - alertProperty: ProductComponentName
      value: ProductComponentName
    - alertProperty: AlertLink
      value: AlertLink
version: 1.0.3
kind: Scheduled

Stages and Predicates

Let binding: `alertList`

let alertList = dynamic(["Unpermitted Usage of Internal Indication (IIN)", "Modbus Address Range Violation", "Function Code Raised Unauthorized Exception", "Unauthorized Access to Siemens S7 Data Block", "Unauthorized Access to Wonderware Tag", "Unauthorized MMS Program Access", "GOOSE Message Type Settings", "Sampled Values Message Type Settings", "Foxboro I/A Unauthorized Operation", "New Activity Detected - CIP Class", "New Activity Detected - CIP Class Service", "New Activity Detected - CIP PCCC Command", "New Activity Detected - CIP Symbol", "New Activity Detected - EtherNet/IP I/O Connection", "New Activity Detected - EtherNet/IP Protocol Command", "New Activity Detected - GSM Message Code", "New Activity Detected - LonTalk Command Codes", "New Activity Detected - LonTalk Network Variable", "New Activity Detected - Ovation Data Request", "New Activity Detected - Read/Write Command (AMS Index Group)", "New Activity Detected - Read/Write Command (AMS Index Offset)", "New Activity Detected - Unauthorized DeltaV Message Type", "New Activity Detected - Unauthorized DeltaV ROC Operation", "New Activity Detected - Using AMS Protocol Command", "New Activity Detected - Using Siemens SICAM Command", "New Activity Detected - Using Suitelink Protocol command", "New Activity Detected - Using Suitelink Protocol sessions", "New Activity Detected - Using Yokogawa VNetIP Command", "Omron FINS Unauthorized Command", "Toshiba Computer Link Unauthorized Command", "Unauthorized ABB Totalflow File Operation", "Unauthorized ABB Totalflow Register Operation", "Unauthorized Access to Siemens S7 Plus Object", "Unauthorized BACNet Object Access", "Unauthorized BACNet Route", "Unauthorized Emerson ROC Operation", "Unauthorized GE SRTP File Access", "Unauthorized GE SRTP Protocol Command", "Unauthorized GE SRTP System Memory Operation", "Unauthorized Mitsubishi MELSEC Command", "Unauthorized MMS Service", "Unauthorized OPC UA Activity", "Unauthorized OPC UA Request/Response", "Unauthorized Profinet Frame Type", "Unauthorized SAIA S-Bus Command", "Unauthorized Siemens S7 Execution of Control Function", "Unauthorized Siemens S7 Execution of User Defined Function", "Unauthorized Siemens S7 Plus Block Access", "Unauthorized Siemens S7 Plus Operation", "Unauthorized SNMP Operation", "Unpermitted Modbus Schneider Electric Extension", "Unpermitted Usage of ASDU Types", "Unpermitted Usage of DNP3 Function Code", "Unpermitted Usage of Modbus Function Code", "Unauthorized Operation was detected by a User Defined Rule", "Unauthorized PLC Configuration Read", "Unauthorized PLC Programming", "Unauthorized PLC Configuration Write", "Unauthorized PLC Program Upload"]);

Stage 1: `source`

SecurityAlert

Stage 2: `where`

| where ProviderName == "IoTSecurity"

Stage 3: `where`

| where AlertName has_any (alertList) 
  or ExtendedProperties has_any ("Illegal Beckhoff AMS Command", "Beckhoff AMS Command Failure")

References alertList (defined above).

Stage 4: `extend`

| extend ExtendedProperties = parse_json(ExtendedProperties)

Stage 5: `where`

| where tostring(ExtendedProperties.isNew) == "True"

Stage 6: `extend`

| extend DeviceId = tostring(ExtendedProperties.DeviceId), 
         SourceDeviceAddress = tostring(ExtendedProperties.SourceDeviceAddress), 
         DestDeviceAddress = tostring(ExtendedProperties.DestinationDeviceAddress), 
         RemediationSteps = tostring(parse_json(RemediationSteps)[0]), 
         Protocol = tostring(ExtendedProperties.Protocol), 
         AlertManagementUri = tostring(ExtendedProperties.AlertManagementUri)

Stage 7: `project`

| project
  TimeGenerated,
  DeviceId,
  ProductName,
  ProductComponentName,
  AlertSeverity,
  AlertName,
  Description,
  Protocol,
  SourceDeviceAddress,
  DestDeviceAddress,
  RemediationSteps,
  Tactics,
  Entities,
  VendorOriginalId,
  AlertLink,
  AlertManagementUri,
  Techniques

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`AlertName`	match	`Foxboro I/A Unauthorized Operation` `Function Code Raised Unauthorized Exception` `GOOSE Message Type Settings` `Modbus Address Range Violation` `New Activity Detected - CIP Class` `New Activity Detected - CIP Class Service` `New Activity Detected - CIP PCCC Command` `New Activity Detected - CIP Symbol` `New Activity Detected - EtherNet/IP I/O Connection` `New Activity Detected - EtherNet/IP Protocol Command` `New Activity Detected - GSM Message Code` `New Activity Detected - LonTalk Command Codes` `New Activity Detected - LonTalk Network Variable` corpus 2 (kusto 2) `New Activity Detected - Ovation Data Request` corpus 2 (kusto 2) `New Activity Detected - Read/Write Command (AMS Index Group)` corpus 2 (kusto 2) `New Activity Detected - Read/Write Command (AMS Index Offset)` corpus 2 (kusto 2) `New Activity Detected - Unauthorized DeltaV Message Type` corpus 2 (kusto 2) `New Activity Detected - Unauthorized DeltaV ROC Operation` corpus 2 (kusto 2) `New Activity Detected - Using AMS Protocol Command` corpus 2 (kusto 2) `New Activity Detected - Using Siemens SICAM Command` corpus 2 (kusto 2) `New Activity Detected - Using Suitelink Protocol command` corpus 2 (kusto 2) `New Activity Detected - Using Suitelink Protocol sessions` corpus 2 (kusto 2) `New Activity Detected - Using Yokogawa VNetIP Command` corpus 2 (kusto 2) `Omron FINS Unauthorized Command` corpus 2 (kusto 2) `Sampled Values Message Type Settings` `Toshiba Computer Link Unauthorized Command` corpus 2 (kusto 2) `Unauthorized ABB Totalflow File Operation` corpus 2 (kusto 2) `Unauthorized ABB Totalflow Register Operation` corpus 2 (kusto 2) `Unauthorized Access to Siemens S7 Data Block` `Unauthorized Access to Siemens S7 Plus Object` corpus 2 (kusto 2) `Unauthorized Access to Wonderware Tag` `Unauthorized BACNet Object Access` corpus 2 (kusto 2) `Unauthorized BACNet Route` corpus 2 (kusto 2) `Unauthorized Emerson ROC Operation` corpus 2 (kusto 2) `Unauthorized GE SRTP File Access` corpus 2 (kusto 2) `Unauthorized GE SRTP Protocol Command` corpus 2 (kusto 2) `Unauthorized GE SRTP System Memory Operation` corpus 2 (kusto 2) `Unauthorized MMS Program Access` `Unauthorized MMS Service` corpus 2 (kusto 2) `Unauthorized Mitsubishi MELSEC Command` corpus 2 (kusto 2) `Unauthorized OPC UA Activity` corpus 2 (kusto 2) `Unauthorized OPC UA Request/Response` corpus 2 (kusto 2) `Unauthorized Operation was detected by a User Defined Rule` corpus 2 (kusto 2) `Unauthorized PLC Configuration Read` corpus 2 (kusto 2) `Unauthorized PLC Configuration Write` corpus 2 (kusto 2) `Unauthorized PLC Program Upload` corpus 2 (kusto 2) `Unauthorized PLC Programming` corpus 2 (kusto 2) `Unauthorized Profinet Frame Type` corpus 2 (kusto 2) `Unauthorized SAIA S-Bus Command` corpus 2 (kusto 2) `Unauthorized SNMP Operation` corpus 2 (kusto 2) `Unauthorized Siemens S7 Execution of Control Function` corpus 2 (kusto 2) `Unauthorized Siemens S7 Execution of User Defined Function` corpus 2 (kusto 2) `Unauthorized Siemens S7 Plus Block Access` corpus 2 (kusto 2) `Unauthorized Siemens S7 Plus Operation` corpus 2 (kusto 2) `Unpermitted Modbus Schneider Electric Extension` corpus 2 (kusto 2) `Unpermitted Usage of ASDU Types` corpus 2 (kusto 2) `Unpermitted Usage of DNP3 Function Code` corpus 2 (kusto 2) `Unpermitted Usage of Internal Indication (IIN)` `Unpermitted Usage of Modbus Function Code` corpus 2 (kusto 2)
`ExtendedProperties`	match	`Beckhoff AMS Command Failure` `Illegal Beckhoff AMS Command`
`ProviderName`	eq	`IoTSecurity` transforms: `cased` corpus 15 (kusto 15)
`isNew`	eq	`True` transforms: `tostring`, `cased` corpus 15 (kusto 15)

Output fields

Fields the rule emits when it matches. Chronicle authors list these in the outcome block; they appear on the detection and $risk_score drives alerting. Sentinel / Defender XDR rules build them up through project / summarize / extend stages. Sentinel maps these into alert fields via entityMappings and customDetails; Defender XDR custom detections surface them as alert fields directly.

Field	Source
`AlertLink`	`project`
`AlertManagementUri`	`project`
`AlertName`	`project`
`AlertSeverity`	`project`
`Description`	`project`
`DestDeviceAddress`	`project`
`DeviceId`	`project`
`Entities`	`project`
`ProductComponentName`	`project`
`ProductName`	`project`
`Protocol`	`project`
`RemediationSteps`	`project`
`SourceDeviceAddress`	`project`
`Tactics`	`project`
`Techniques`	`project`
`TimeGenerated`	`project`
`VendorOriginalId`	`project`

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Unauthorized PLC changes (Microsoft Defender for IoT)

MITRE ATT&CK coverage

Rule body kusto

Stages and Predicates

Let binding: `alertList`

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `extend`

Stage 5: `where`

Stage 6: `extend`

Stage 7: `project`

Indicators

Output fields

Keyboard shortcuts

Search operators

Unauthorized PLC changes (Microsoft Defender for IoT)

MITRE ATT&CK coverage

Rule body kusto

Stages and Predicates

Let binding: alertList

Stage 1: source

Stage 2: where

Stage 3: where

Stage 4: extend

Stage 5: where

Stage 6: extend

Stage 7: project

Indicators

Output fields

Let binding: `alertList`

Stage 1: `source`

Stage 2: `where`

Stage 3: `where`

Stage 4: `extend`

Stage 5: `where`

Stage 6: `extend`

Stage 7: `project`