CTI · reviewed · 2026-10-04

CISA AA26-231A Active Threat to Siemens S7 Series PLCs

Full story & timeline

MITRE ATT&CK

• T1595 Active Scanning Reconnaissance
• T1059 Command and Scripting Interpreter Execution

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Snap7 S7comm Tooling Execution Outside OT Monitoring
id: 1b442897-ebcf-4843-9623-731572197813
status: experimental
description: >
  Detects process command lines referencing the snap7 S7comm library (snap7.dll
  or python-snap7), the open-source building block CISA AA26-231A names for the
  AI-assisted scripts used to read and write Siemens S7 PLC memory,
  configuration, and ladder logic. The advisory describes persistent scanning
  for Internet-exposed S7-200, S7-300, S7-400, S7-1200 and S7-1500 units;
  snap7 execution outside known engineering and monitoring workflows indicates
  unauthorized S7comm tooling on the host.
references:
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
  - https://www.securityweek.com/hackers-using-ai-to-target-siemens-plcs-in-critical-us-sectors/
author: Tia N. List
date: 2026/10/04
tags:
  - attack.t1595
  - attack.reconnaissance
  - attack.t1059
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'snap7'
      - 'Snap7'
      - 'SNAP7'
  condition: selection
falsepositives:
  - Legitimate OT engineering workstations and monitoring tools that embed the snap7 library
  - Authorized diagnostics running python-snap7 scripts against PLC test benches
level: low

References

• https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a
• https://www.securityweek.com/hackers-using-ai-to-target-siemens-plcs-in-critical-us-sectors/