# Ics Ot Overview

> ICS / OT attack category — Modbus, BACnet, S7Comm, DNP3. Routing skill: fingerprint the industrial protocol by port + Wireshark dissector, then load the matching sub-skill. SAFETY-CRITICAL: always confirm written scope before any write/control class action.

- Skill: `purpleailab/ics-ot-overview` (Agent Skill)
- Install (CLI): `npx skillmds@latest add purpleailab/ics-ot-overview`
- Raw SKILL.md: https://api.skillmd.com/api/skills/purpleailab/ics-ot-overview/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: purpleailab (https://skillmd.com/u/purpleailab)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/purpleailab/ics-ot-overview

---


# Industrial Control Systems / OT Category

This is a routing skill for industrial protocol engagements. Identify the protocol by port + wire format, then load the matching sub-skill.

## SAFETY FIRST

Writes to ICS/OT devices can move physical actuators — open valves, trip breakers, freeze pumps, override safety setpoints. **Confirm written scope authorization for any write/control class operation. Read-only enumeration is generally safe.** If unsure, default to read-only.

## Protocol routing

| Protocol | TCP/UDP Port | Sub-skill | Wire fingerprint |
|---|---|---|---|
| **Modbus TCP** | TCP 502 | `modbus` | MBAP header, function codes 1-127 |
| **BACnet/IP** | UDP 47808 | `bacnet` | APDU PDU types 0-15, Who-Is/I-Am |
| **Siemens S7Comm** | TCP 102 | `s7comm` | ISO-on-TCP (RFC 1006) + S7 protocol IDs |
| **DNP3** | TCP 20000 | `dnp3` | Start bytes 0x05 0x64, link layer |
| **EtherNet/IP + CIP** | TCP 44818, UDP 2222 | (use enumeration; CVE-driven exploits) | ENIP encapsulation header |
| **PROFINET RT** | UDP 34962-34964 | (use enumeration) | EtherType 0x8892 (L2) |
| **OPC UA** | TCP 4840 | (use enumeration) | OPC UA Binary protocol |

## Quick fingerprint sweep

```bash
nmap -sV -p 102,502,20000,44818,4840 --script="*ics*,*scada*,modbus-discover,s7-info,dnp3-info,bacnet-info,enip-info" 10.0.0.0/24
```

## Useful tooling

| Tool | Use |
|---|---|
| `pymodbus`, `mbtget` | Modbus client |
| `bacpypes`, `bacnet-stack` | BACnet client |
| `snap7`, `python-snap7` | S7Comm client |
| `opendnp3`, `dnp3-toolkit` | DNP3 master |
| `cip-py`, `pylogix` | EtherNet/IP / CIP (Allen-Bradley) |
| `python-opcua` / `opcua-asyncio` | OPC UA |
| `ISF` (Industrial Security Framework) | Mass enumeration + exploit framework |
| `PLCinject` | Siemens S7 logic injection |

## Defender baseline (useful for triage)

ICS-CERT advisories (https://www.cisa.gov/uscert/ics/advisories), Dragos Threat Intel Briefs, Nozomi / Claroty / Tenable.ot for telemetry. Understanding what defenders see helps you stay below detection thresholds.