Unauthorised Modbus Write: Find the Setpoint Change
Operators on a heating line saw an outlet temperature target jump on the HMI with no one at the console. The OT network has a passive tap in front of the PLC, and the controls engineer exported about a minute and a quarter of traffic around the change.
The process network is 10.50.0.0/24: an HMI, a historian and one PLC. Only the HMI should ever talk Modbus/TCP to the PLC. Temperatures are stored in tenths of a degree (720 means 72.0 °C). Everything in this file is synthetic: private addresses, made-up values and locally administered MAC addresses.
What you will find in the capture
- A steady once-a-second conversation between two hosts on TCP port 502
- ARP from a device that is not on the asset list
- One command that is different from every other one, and what the polls show afterwards
Unauthorised Modbus Write: Find the Setpoint Change
Operators on a heating line saw an outlet temperature target jump on the HMI with no one at the console. The OT network has a passive tap in front of the PLC, and the controls engineer exported about a minute and a quarter of traffic around the change.
The process network is 10.50.0.0/24: an HMI, a historian and one PLC. Only the HMI should ever talk Modbus/TCP to the PLC. Temperatures are stored in tenths of a degree (720 means 72.0 °C). Everything in this file is synthetic: private addresses, made-up values and locally administered MAC addresses.
You will practise
- Read Modbus/TCP: unit ID, function code, register address and values
- Recognise a normal polling baseline before looking for the odd one out
- Find write commands with a display filter
- Tie a command to its effect in the process data
- Respond to an unauthorised change on a live process safely
8 questions. Each hint costs 25% of that question’s points; a wrong try costs a little. Your score is out of 100.
Loading the capture…
Loading…
Sample report · illustrative data
Sample result: Cleartext HTTP Login case
Example run of the starter case on a synthetic capture (documentation and private IP ranges, .example names, a made-up account).
Scoring
- Score
- 82/100 (example)
- Grade
- B, solid analysis
- Hints used
- 2 (example)
- Time
- 6m 40s (example)
Findings in the example run
| Question | Filter that finds it | Read |
|---|---|---|
| Where is the login submitted? | http.request.method == "POST" | One POST to the intranet over port 80 |
| What crossed the wire? | http.file_data contains "username=" | Username and password readable as typed |
| Did it work? | http.response.code == 302 | Redirect plus a session cookie without Secure |
Recommended next steps (example)
- Serve the intranet over HTTPS only, with HSTS and Secure cookies
- Reset the exposed password and end the account's sessions
- Search wider captures for other cleartext logins
Made-up example data. Your own run uses your inputs. Downloads of the full report need Pro.
Downloads
Take the capture into Wireshark or your own tools, and keep the analyst report with the answer key.
18.4 kB · 228 packets · SHA-256 253b1de81044c13bbd7998425896e2a475684d1b5c16ac1f4f353611f174772e
Sample of the debrief
This capture shows an HMI reading a PLC’s registers once a second, and a device that is not on the asset list connecting to the same PLC, reading the same block and writing one register: a temperature setpoint, raised well above its normal value. The polls that follow show the PLC accepted it. Modbus has no authentication, so any host that can reach port 502 can do this.
The full debrief, with next steps and the MITRE ATT&CK mapping, appears when you finish the case.
What you will learn
- Read Modbus/TCP: unit ID, function code, register address and values
- Recognise a normal polling baseline before looking for the odd one out
- Find write commands with a display filter
- Tie a command to its effect in the process data
- Respond to an unauthorised change on a live process safely
Frequently asked questions
How do you find a Modbus write in a PCAP?
Filter on the function code: modbus.func_code == 6 for Write Single Register, 16 for Write Multiple Registers, 5 and 15 for coils. In Wireshark, modbus.func_code in {5 6 15 16} shows every write type.
What is a normal Modbus baseline?
Usually one client (an HMI or SCADA server) polling each PLC at a fixed interval with read functions such as 3 (Read Holding Registers) for the same addresses. Writes are rare and come from known engineering hosts.
Does Modbus/TCP have authentication?
No. Any host that can reach TCP port 502 on a PLC can read and write registers, which is why network segmentation and monitoring matter so much in OT.
How do you see what value was written?
Open the Modbus/TCP layer of the write query: Reference number is the register, Data is the value. The poll responses afterwards show whether the PLC kept it.
Is this real traffic?
No. PlayCISO generated it from a fixed seed with private addresses, locally administered MAC addresses and made-up process values. No real device or plant is involved.