Vendor proprietary
PCCC / CSP
Rockwell Automation's legacy command set for SLC 500, PLC-5 and MicroLogix controllers. It predates EtherNet/IP and is still reachable on many brownfield sites, either natively over CSP on 2222/TCP or tunnelled inside CIP messages on 44818/TCP.
How it works
A client sends PCCC command/function-code pairs that address data table files (N, B, F, T, C) directly. Legacy CSP framing wraps these on 2222/TCP; modern Logix hardware accepts the same commands wrapped in CIP for backwards compatibility.
Communication patternClient opens a session → issues typed read/write against data table files → controller replies.
Fact sheet
Why should I care?
Understanding PCCC / CSP is what lets you tell a routine poll from a process-affecting command. Detection here depends on knowing which peers, function codes and timings are normal for your plant.
Key functions and operations
- Typed read / write of data table files
- Diagnostic status
- Upload / download of ladder programs
- Controller mode change
Security concerns
- No authentication or integrity protection whatsoever
- Program download and mode change are ordinary commands, not privileged operations
- Tunnelled PCCC inside CIP can bypass rules that only inspect 2222/TCP
- Affected controller families are frequently past end of support with no firmware fix path
What normal looks like
- A small, stable set of HMI and SCADA clients performing typed reads
- Programming activity only from named engineering hosts
What deserves attention
- Typed writes from an HMI that has only ever read
- PCCC-in-CIP from a host with no engineering role
- Mode change or download outside a change window
Hunting ideas
- unauthorized-plc-programming
- controller-mode-change
- protocol-write-activity
Defensive controls
- Restrict 2222/TCP and 44818/TCP to named clients at the cell boundary
- Inspect CIP payloads for embedded PCCC rather than filtering on port alone
- Migrate SLC/PLC-5 estates to Logix hardware where the process allows, and compensate with segmentation where it does not
- Baseline controller programs with FactoryTalk AssetCentre-style comparison
Related ATT&CK for ICS techniques
Seen in incidents
- stuxnet
Sources & further reading