← Back to OT / ICS Track

XUTS OT Operator Node

PLC Enumeration

PLC enumeration is the process of identifying programmable logic controllers, their vendors, reachable services, communication paths, and operational role without changing controller state.

Difficultymedium
XP Reward100
PurdueL3/L2
AssetOT System
OT / ICSSafety Aware

OT Safety Gate

Assume every action can affect the process until proven otherwise.

OT testing is not just exploitation. It is controlled validation around availability, safety, process continuity, deterministic operations, and recovery.

Prefer passive enumeration before active scanning. OT networks may contain fragile controllers, legacy stacks, deterministic traffic patterns, and vendor-supported systems that react poorly to noisy probes.
Never perform protocol writes, force coils, download logic, change controller state, or interact with safety systems in production unless the scope, approval, rollback plan, and operational window are explicit.
Treat engineering workstations, historians, HMI servers, jump hosts, and OT domain controllers as high-impact assets because they can affect visibility, control, recovery, and trusted engineering workflows.
Coordinate testing with operations, control engineers, vendors, and site leadership. In OT, the blast radius can include production, safety, environmental impact, and physical equipment damage.

What it is

PLC enumeration is the process of identifying programmable logic controllers, their vendors, reachable services, communication paths, and operational role without changing controller state.

Why it matters

PLCs directly interact with physical processes. Enumeration must be cautious, scoped, and focused on identification rather than manipulation.

How to identify it

Identify controller IPs from engineering workstation projects, historian sources, HMI configurations, or network documentation.Look for vendor-specific services and protocol ports.Use passive packet captures or approved read-only queries when possible.Correlate controller names with process areas and engineering project files.

Expected output

A list of suspected PLCs or controller-adjacent devices.Vendor or protocol hints.Evidence of which workstation, HMI, or historian communicates with the controller.

Success looks like

You can identify likely controllers without modifying them.You can explain which systems communicate with them.You can document controller exposure and segmentation risk safely.

Failure looks like

You perform exploit testing against controllers.You write to controller memory or logic.You confuse safe identification with safe manipulation.

Troubleshooting

If controller identity is unclear, inspect engineering projects and HMI configurations before network probing.
If direct enumeration is not approved, use indirect sources such as historian configs, firewall logs, and ARP tables.
If a device is fragile or unknown, stop at evidence collection and document the risk.

Lab setup ideas

Use a simulated PLC service in a contained lab network.
Practice mapping PLC relationships from fake HMI and historian configs.
Create a safe checklist for controller enumeration.

EXO automation ideas

Flag PLC-like systems and automatically downgrade recommended actions to passive or read-only.
Generate controller relationship maps from engineering files, HMI configs, and historian sources.
Warn when proposed actions could alter controller state.

Operational Tradecraft

How to talk about this like an OT operator

Lead with process risk.

Explain how this topic affects visibility, control, safety, availability, recovery, and engineering workflows.

Explain passive-first methodology.

Mention SPAN/TAP collection, firewall review, switch tables, historian visibility, HMI observation, configuration review, and controlled validation before active probing.

Tie the concept to an attack path.

Connect the node to IT/OT pivoting, Level 3 operations, historians, engineering workstations, HMIs, PLCs, protocols, vendor access, and segmentation boundaries.

EXO Guidance

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.