Countering Modbus TCP Function Code Abuse Attacks Against PyModbus Industrial Controllers Through Function-Code Whitelisting and Command-Pattern Monitoring

Industrial organizations use Modbus TCP to exchange control and monitoring information between industrial controllers, supervisory systems, engineering workstations, and other operational-technology components.

Modbus TCP allows devices to perform operations such as reading coils, reading registers, writing coils, and writing holding registers. Because these operations can directly influence industrial process data or control states, unauthorized Modbus commands can create significant operational and safety risks.

An attacker who gains access to an industrial network may send unauthorized Modbus function codes to an industrial controller. If the controller accepts commands that the requesting device or user is not authorized to perform, the attacker may modify process values, change control states, or interfere with industrial operations.

In this use case, a controlled Industry 4.0 / OT laboratory environment is created using Ubuntu virtual machines. A PyModbus-based industrial controller simulator represents the controlled Modbus TCP device.

Kali Linux is used as the authorized security-testing system. A controlled Modbus TCP command-abuse simulation is performed against the laboratory controller.

No real industrial equipment or physical production process is affected. The simulation uses only a software-based industrial controller and harmless laboratory registers.

The defensive mechanism introduces Modbus function-code whitelisting, register-access authorization, command-pattern monitoring, and security alerting.

The security monitoring system identifies Modbus operations that fall outside the expected communication behavior. Unauthorized write operations or unexpected function-code usage generate security alerts and can trigger the configured containment response.

After detection, the suspicious Modbus activity is investigated and contained. Legitimate industrial communication is then tested to verify that authorized controller operations continue normally.

The complete defensive workflow is: Modbus TCP Controller → Unauthorized Function Code → Command Monitoring → Function-Code Validation → Suspicious Modbus Activity → Security Alert → Automated Response → Command Containment → Controller Validation.

Modbus TCP is an industrial communication protocol used to exchange data between control systems and industrial devices. Industrial applications may use Modbus TCP for reading sensor values, monitoring process states, and writing control values to connected devices.

Modbus TCP communication can become a security risk when the industrial network does not adequately restrict which systems can issue control-related commands.A compromised workstation or unauthorized device may attempt to send Modbus write operations to an industrial controller. If the controller accepts unexpected function codes or unauthorized register modifications, an attacker may influence the industrial process represented by the laboratory environment.

The security problem is therefore:

The proposed solution introduces Modbus function-code allowlisting, register-access control, command-pattern monitoring, security alerting, and automated response to detect and contain unauthorized industrial control commands.

The attack scenario simulates unauthorized use of Modbus TCP function codes against a controlled industrial controller. A laboratory testing system sends controlled Modbus requests to the PyModbus-based industrial controller. The simulation focuses on unauthorized write-related Modbus operations that would normally require specific authorization. The objective is to determine whether the security controls can identify unexpected Modbus commands and prevent unauthorized modification of protected industrial process values.

The primary security concept is industrial protocol command validation.

Instead of allowing every Modbus TCP operation from every connected system, the security architecture defines which function codes and register ranges are expected for each authorized communication relationship. A legitimate industrial communication flow should use only the Modbus operations required by the specific application. Unexpected write operations, unauthorized function codes, or abnormal command sequences should be treated as suspicious and investigated.

The secure processing flow is: