Detect Rockwell Automation Logix Controllers Insufficient Credential Protection (CVE-2021-22681) in Sumo Logic CSE
CVE-2021-22681 is an insufficient protection of credentials vulnerability (CWE-522) affecting Rockwell Automation multiple products including Logix controllers. An attacker can intercept or obtain weakly protected credentials used to authenticate with Logix controllers, enabling authentication bypass. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog and poses critical risk in OT/ICS environments where unauthorized controller access could cause process disruption or physical damage.
MITRE ATT&CK
Sumo Detection Query
_index=ot_security OR _sourceCategory=network/ics OR _sourceCategory=firewall
| where dest_port in ("44818", "2222", "2221") or protocol matches /(?i)(EtherNet.IP|CIP)/
| where _raw matches /(?i)(logix|controllogix|compactlogix|guardlogix|rockwell)/
| parse regex "(?<src_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" as src_ip
| parse regex "dest[_\\s]?ip[=:\\s]+(?<dest_ip>\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})" as dest_ip nodrop
| count as connection_count by src_ip, dest_ip, dest_port, protocol
| where connection_count > 0
| sort by connection_count descSumo Logic query detecting EtherNet/IP and CIP protocol connections targeting Rockwell Logix devices, supporting identification of CVE-2021-22681 exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Routine engineering workstation connections for PLC programming
- Asset discovery scans in OT environments
- SCADA system polling of Logix controllers
Other platforms for CVE-2021-22681
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1EtherNet/IP Controller Enumeration via nmap
Expected signal: Network connection events from the scanning host to port 44818 on multiple destination IPs; IDS alerts for CIP/EtherNet/IP enumeration
- Test 2CIP Session Credential Capture via Wireshark
Expected signal: Passive capture produces no active network events; detection depends on promiscuous mode detection or IDS passive analysis alerts
- Test 3RSLinx Classic Unauthorized Connection Attempt
Expected signal: Windows process creation for RSLinx.exe; network connection from non-engineering workstation to controller port 44818; controller audit log entry for unauthorized connection attempt
Response Playbook
Triage
- Identify the source IP and device initiating connections to Logix controllers on port 44818; determine if it is a known, authorized engineering workstation or historian server
- Check the OT asset inventory to confirm which Rockwell Logix controllers (ControlLogix, CompactLogix, GuardLogix, SoftLogix, DriveLogix) are reachable from the flagged source and whether they are patched or mitigated per Rockwell advisory 1130301
- Review network capture or IDS logs for CIP/EtherNet/IP session content — look for credential exchange patterns, unusual session counts, or connections from non-engineering hosts (IT hosts, DMZ systems, external IPs)
- Check for concurrent alerts indicating lateral movement from IT to OT network segments, which would suggest an attacker pivoting to reach Logix controllers
Containment
- Immediately isolate the suspected unauthorized source host from the OT network using firewall ACLs or VLAN changes; engage the OT/ICS network administrator before taking action to avoid disrupting live processes
- Apply Rockwell-recommended mitigations: enable CIP Security where supported, update controller firmware to a patched version per advisory 1130301, and enforce network segmentation so only authorized engineering workstations can reach controller EtherNet/IP ports
Evidence Collection
- Capture full packet data (PCAP) for EtherNet/IP sessions between the flagged source and affected Logix controllers, preserving credential exchange and session establishment frames
- Export controller audit logs and diagnostic buffers from Logix controllers via Studio 5000 or RSLinx; document firmware version, configured access levels, and any recent configuration changes
Escalation Criteria
- !Escalate immediately if the flagged source IP is not a known engineering workstation, historian, or authorized vendor system — this indicates unauthorized access to the OT network
- !Escalate if evidence shows controller configuration was modified, a new project was downloaded, or the controller was placed in Remote Program mode by an unrecognized session
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Controller audit log entries showing unexpected authentication events, remote program mode changes, or project downloads from unrecognized source IPs - >
Network PCAP of EtherNet/IP (port 44818) sessions containing CIP Forward Open requests and authentication exchanges - >
RSLinx or Studio 5000 connection history logs on engineering workstations showing which controllers were accessed and by whom
Tuning Guidance
Build an allowlist of authorized engineering workstation IPs, historian servers, and SCADA servers that legitimately connect to Logix controllers on port 44818. Suppress alerts for these known-good sources after validation. In environments using Claroty, Nozomi, or Dragos, use their asset inventories to enrich alerts with controller criticality and zone. Raise confidence to high once allowlist is established. If CIP Security is enabled on controllers, filter authenticated sessions and focus detection on unauthenticated or legacy protocol sessions.
Hunting Queries
Hunt for hosts making high-volume or broad EtherNet/IP connections across multiple Logix controllers, which may indicate scanning, credential harvesting, or worm propagation exploiting CVE-2021-22681
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where DestinationPort == 44818
| summarize ConnectionCount=count(), DistinctControllers=dcount(DestinationIP) by SourceIP, bin(TimeGenerated, 1h)
| where DistinctControllers > 3 or ConnectionCount > 100
| order by ConnectionCount descindex=ot_security dest_port=44818
| bucket span=1h _time
| stats count AS conn_count, dc(dest_ip) AS distinct_controllers BY src_ip, _time
| where conn_count > 100 OR distinct_controllers > 3
| sort - conn_countAtomic Red Team Tests
Enumerate Rockwell Logix controllers on the network using nmap with EtherNet/IP service detection scripts to identify reachable controllers and their firmware versions
Command
nmap -p 44818 --script enip-info <TARGET_SUBNET> -oN /tmp/logix_enum.txtCleanup
rm -f /tmp/logix_enum.txtExpected Telemetry
Network connection events from the scanning host to port 44818 on multiple destination IPs; IDS alerts for CIP/EtherNet/IP enumeration
Expected Detection
Alert fires on port 44818 connections to multiple Logix controller IPs from a single non-engineering source
Passively capture EtherNet/IP traffic on the OT network segment to intercept CIP session credentials transmitted in cleartext or weakly protected form
Command
tshark -i eth0 -f 'tcp port 44818' -w /tmp/cip_capture.pcap -a duration:60Cleanup
rm -f /tmp/cip_capture.pcapExpected Telemetry
Passive capture produces no active network events; detection depends on promiscuous mode detection or IDS passive analysis alerts
Expected Detection
OT IDS or network anomaly detection identifies promiscuous mode or unexpected SPAN/TAP session on OT segment
Attempt to connect to a Rockwell Logix controller using RSLinx Classic from an unauthorized workstation to test if credential interception allows authentication bypass
Command
& 'C:\Program Files (x86)\Rockwell Software\RSLinx\RSLinx.exe' /node <CONTROLLER_IP> /port 44818Cleanup
Close RSLinx connection; no persistent changes expectedExpected Telemetry
Windows process creation for RSLinx.exe; network connection from non-engineering workstation to controller port 44818; controller audit log entry for unauthorized connection attempt
Expected Detection
Alert fires on RSLinx.exe network connection from non-allowlisted source IP to EtherNet/IP port