CVE-2021-22681 Google Chronicle · YARA-L

Detect Rockwell Automation Logix Controllers Insufficient Credential Protection (CVE-2021-22681) in Google Chronicle

CVE-2021-22681 is an insufficient protection of credentials vulnerability (CWE-522) affecting Rockwell Automation multiple products including Logix controllers. An attacker can intercept or obtain weakly protected credentials used to authenticate with Logix controllers, enabling authentication bypass. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and poses critical risk in OT/ICS environments where unauthorized controller access could cause process disruption or physical damage.

MITRE ATT&CK

Tactic
Credential Access Initial Access Lateral Movement

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule cve_2021_22681_rockwell_logix_credential_abuse {
  meta:
    author = "df00tech"
    description = "Detects EtherNet/IP connections to Rockwell Logix controllers potentially exploiting CVE-2021-22681 insufficient credential protection"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2021-22681"
  events:
    $network.metadata.event_type = "NETWORK_CONNECTION"
    $network.target.port = 44818
    (
      $network.target.hostname /(?i)(logix|controllogix|compactlogix|guardlogix|rockwell)/ or
      $network.target.application = "EtherNet/IP" or
      $network.target.application = "CIP"
    )
  condition:
    $network
}
critical severity medium confidence

Chronicle YARA-L rule detecting network connections to port 44818 (EtherNet/IP) targeting Rockwell Logix controllers, which may indicate exploitation of CVE-2021-22681 credential interception vulnerability.

Data Sources

Chronicle network telemetryGoogle Cloud Chronicle OT feeds

Required Tables

network_connection events

False Positives & Tuning

  • Legitimate engineering workstation connections for controller programming
  • Authorized remote access sessions by OEM vendors
  • SCADA and historian polling of Logix devices

Other platforms for CVE-2021-22681

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1EtherNet/IP Controller Enumeration via nmap

    Expected signal: Network connection events from the scanning host to port 44818 on multiple destination IPs; IDS alerts for CIP/EtherNet/IP enumeration

  2. Test 2CIP Session Credential Capture via Wireshark

    Expected signal: Passive capture produces no active network events; detection depends on promiscuous mode detection or IDS passive analysis alerts

  3. Test 3RSLinx Classic Unauthorized Connection Attempt

    Expected signal: Windows process creation for RSLinx.exe; network connection from non-engineering workstation to controller port 44818; controller audit log entry for unauthorized connection attempt

Last updated: 2026-06-19 Research depth: standard
References (3)

Response Playbook

Triage

  1. Identify the source IP and device initiating connections to Logix controllers on port 44818; determine if it is a known, authorized engineering workstation or historian server
  2. Check the OT asset inventory to confirm which Rockwell Logix controllers (ControlLogix, CompactLogix, GuardLogix, SoftLogix, DriveLogix) are reachable from the flagged source and whether they are patched or mitigated per Rockwell advisory 1130301
  3. Review network capture or IDS logs for CIP/EtherNet/IP session content — look for credential exchange patterns, unusual session counts, or connections from non-engineering hosts (IT hosts, DMZ systems, external IPs)
  4. Check for concurrent alerts indicating lateral movement from IT to OT network segments, which would suggest an attacker pivoting to reach Logix controllers

Containment

  1. Immediately isolate the suspected unauthorized source host from the OT network using firewall ACLs or VLAN changes; engage the OT/ICS network administrator before taking action to avoid disrupting live processes
  2. Apply Rockwell-recommended mitigations: enable CIP Security where supported, update controller firmware to a patched version per advisory 1130301, and enforce network segmentation so only authorized engineering workstations can reach controller EtherNet/IP ports

Evidence Collection

  1. Capture full packet data (PCAP) for EtherNet/IP sessions between the flagged source and affected Logix controllers, preserving credential exchange and session establishment frames
  2. Export controller audit logs and diagnostic buffers from Logix controllers via Studio 5000 or RSLinx; document firmware version, configured access levels, and any recent configuration changes

Escalation Criteria

  • !Escalate immediately if the flagged source IP is not a known engineering workstation, historian, or authorized vendor system — this indicates unauthorized access to the OT network
  • !Escalate if evidence shows controller configuration was modified, a new project was downloaded, or the controller was placed in Remote Program mode by an unrecognized session

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Controller audit log entries showing unexpected authentication events, remote program mode changes, or project downloads from unrecognized source IPs
  • >Network PCAP of EtherNet/IP (port 44818) sessions containing CIP Forward Open requests and authentication exchanges
  • >RSLinx or Studio 5000 connection history logs on engineering workstations showing which controllers were accessed and by whom

Tuning Guidance

Build an allowlist of authorized engineering workstation IPs, historian servers, and SCADA servers that legitimately connect to Logix controllers on port 44818. Suppress alerts for these known-good sources after validation. In environments using Claroty, Nozomi, or Dragos, use their asset inventories to enrich alerts with controller criticality and zone. Raise confidence to high once allowlist is established. If CIP Security is enabled on controllers, filter authenticated sessions and focus detection on unauthenticated or legacy protocol sessions.

Hunting Queries

Hunt for hosts making high-volume or broad EtherNet/IP connections across multiple Logix controllers, which may indicate scanning, credential harvesting, or worm propagation exploiting CVE-2021-22681

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationPort == 44818
| summarize ConnectionCount=count(), DistinctControllers=dcount(DestinationIP) by SourceIP, bin(TimeGenerated, 1h)
| where DistinctControllers > 3 or ConnectionCount > 100
| order by ConnectionCount desc
Hunting — SPL
spl 
index=ot_security dest_port=44818
| bucket span=1h _time
| stats count AS conn_count, dc(dest_ip) AS distinct_controllers BY src_ip, _time
| where conn_count > 100 OR distinct_controllers > 3
| sort - conn_count

Atomic Red Team Tests

Test 1 EtherNet/IP Controller Enumeration via nmap
linux

Enumerate Rockwell Logix controllers on the network using nmap with EtherNet/IP service detection scripts to identify reachable controllers and their firmware versions

Command

bash 
nmap -p 44818 --script enip-info <TARGET_SUBNET> -oN /tmp/logix_enum.txt

Cleanup

bash 
rm -f /tmp/logix_enum.txt

Expected Telemetry

Network connection events from the scanning host to port 44818 on multiple destination IPs; IDS alerts for CIP/EtherNet/IP enumeration

Expected Detection

Alert fires on port 44818 connections to multiple Logix controller IPs from a single non-engineering source

Test 2 CIP Session Credential Capture via Wireshark
linux

Passively capture EtherNet/IP traffic on the OT network segment to intercept CIP session credentials transmitted in cleartext or weakly protected form

Command

bash 
tshark -i eth0 -f 'tcp port 44818' -w /tmp/cip_capture.pcap -a duration:60

Cleanup

bash 
rm -f /tmp/cip_capture.pcap

Expected Telemetry

Passive capture produces no active network events; detection depends on promiscuous mode detection or IDS passive analysis alerts

Expected Detection

OT IDS or network anomaly detection identifies promiscuous mode or unexpected SPAN/TAP session on OT segment

Test 3 RSLinx Classic Unauthorized Connection Attempt
windows

Attempt to connect to a Rockwell Logix controller using RSLinx Classic from an unauthorized workstation to test if credential interception allows authentication bypass

Command

powershell 
& 'C:\Program Files (x86)\Rockwell Software\RSLinx\RSLinx.exe' /node <CONTROLLER_IP> /port 44818

Cleanup

powershell 
Close RSLinx connection; no persistent changes expected

Expected Telemetry

Windows process creation for RSLinx.exe; network connection from non-engineering workstation to controller port 44818; controller audit log entry for unauthorized connection attempt

Expected Detection

Alert fires on RSLinx.exe network connection from non-allowlisted source IP to EtherNet/IP port

Related Detections

Tactic Hubs

TA0006Credential AccessTA0001Initial AccessTA0008Lateral Movement

Related Techniques

T1552Unsecured CredentialsT1078Valid AccountsT1021Remote Services

Same Tactic: Credential Access

Popular Detections