The EtherNet/IP IDS Rules are part of Digital Bond’s Quickdraw SCADA IDS research project. The EtherNet/IP rules require the EtherNet/IP preprocessor and plugins.
A list of the rules and links to the documentation are including in the table below.
| SID | Message |
| 1111501 | Reboot or Restart from Unauthorized Client |
| 1111502 | Reboot or Restart from Unauthorized Client |
| 1111503 | Reboot or Restart from Authorized Client |
| 1111504 | Reboot or Restart from Authorized Client |
| 1111505 | Unlock PLC Attempt from Unauthorized Client |
| 1111506 | Unlock PLC Attempt from Authorized Client |
| 1111507 | Lock PLC Attempt from Unauthorized Client |
| 1111508 | Lock PLC Attempt from Unauthorized Client |
| 1111509 | Lock PLC Attempt from Authorized Client |
| 1111510 | Lock PLC Attempt from Authorized Client |
| 1111511 | Stop Detected from Unauthorized Client |
| 1111512 | Stop Detected from Authorized Client |
| 1111513 | Remote Mode Change Attempt from Unauthorized Client |
| 1111514 | Remote Mode Change Attempt from Authorized Client |
| 1111515 | Software Upload from Unauthorized Client |
| 1111516 | Software Upload from Authorized Client |
