If you want to communicate to WinCC itself and not a S7 plc, then you need to use the WinCC programming api. This is split into two general parts: RT (runtime) and CS (configuration). With the runtime api you can read/write tags of the WinCC runtime, or connect to the message or taglogging runtime and get data. With the configuration api you can create / modifiy pictures, create variables and alarms and so on.
Both apis are in plain C in several dlls, so you need to program a wrapper to use them out of a .Net application. But the methods are not documented. The documentation you get when you buy the so called WinCC ODK (open development kit), which has documentation, programming examples, and from what I've read it may have a .Net wrapper in the latest versions. But it's not cheap.
The runtime api can be get open out of the WinCC professional documentation (which uses a WinCC 7.4/7.5 as runtime), but you need to compare and modify it to the minor differences in the WinCC 7.4 libraries.