Suspicious Python process loading snap7 S7comm library

Emiliano Mema@Nosalva

•updated Aug 28, 2026•4•0•5

This rule detects instances where a Python interpreter loads the 'snap7.dll' library or executes processes containing 'snap7' or 'python-snap7' in the command line. Snap7 is an open-source library used for communication with Siemens S7 PLCs. This detection helps identify potential unauthorized or suspicious interaction with Industrial Control Systems (ICS) via Python scripts.