Vendor-associated
Beckhoff ADS/AMS
Automation Device Specification messaging used by TwinCAT systems for variable access, state control and engineering operations between AMS network IDs.
48898/TCPTCPEncryption: Optional
How it works
Devices are addressed by AMS NetID; ADS commands read/write variables, change device state and support engineering functions once an ADS route exists.
Communication patternEngineering workstation (ADS route) → runtime device.
Fact sheet
TransportTCP
Ports48898/TCP
AuthenticationOptional
PurdueLevel 2 – Level 1
EnvironmentsTwinCAT automation environments
DevicesIndustrial PC, Soft PLC, Engineering workstation
IndustriesManufacturing, Pharmaceutical
Why should I care?
Understanding Beckhoff ADS/AMS is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Read/write variables
- Read state / write control
- Notification subscriptions
- File and system services
Security concerns
- ADS routes act as trust relationships and are rarely audited
- State control can stop a runtime
- Legacy configurations allow unauthenticated routes
What normal looks like
- A documented, small route table per device
What deserves attention
- New ADS route added
- Write control commands from non-engineering hosts
Hunting ideas
- unauthorized-plc-programming
- controller-mode-change
Defensive controls
- Audit ADS route tables
- Enable route authentication features
- Restrict 48898/TCP by conduit
Related ATT&CK for ICS techniques
T0843T0858
Sources & further reading