{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0800","id":"T0800","name":"Activate Firmware Update Mode","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0800","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"c29fa9a5752203cf1db70dd773c9c03bf01859c18bb65a8348366f419db16839","description":"Adversaries may activate firmware update mode on devices to prevent expected response functions from engaging in reaction to an emergency or process malfunction. For example, devices such as protection relays may have an operation mode designed for firmware installation. This mode may halt process monitoring and related functions to allow new firmware to be loaded. A device left in update mode may be placed in an inactive holding state if no firmware is provided to it. By entering and leaving a device in this mode, the adversary may deny its usual functionalities.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0800","external_id":"T0800"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0108","name":"Device Alarm","page":"telemetry/DC0108/","kind":"attack_component","category":"Industrial operations and physical process","description":"Device-generated alarms about equipment or controller state.","collection_focus":"Subscribe to supported device alarm/audit channels; retain code, severity, source asset and acknowledgement/clear times.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["asset_id","alarm_code","severity","active"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0108","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","alarm_code":"LAB_COMM_LOSS","severity":"warning","active":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"attack_component","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"ics/T0800","id":"T0800","name":"Activate Firmware Update Mode","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0800","technique_page":"techniques/ics/T0800/","page":"detections/ics/T0800/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0802","name":"Detection of Activate Firmware Update Mode","url":"https://attack.mitre.org/detectionstrategies/DET0802","stix_id":"x-mitre-detection-strategy--6d2ba563-0aa9-4f64-a14d-da62b694b495","relationship_id":"relationship--d80c615e-addc-49c8-a2b9-991e24678d86","description":"","analytics":[{"id":"AN1934","name":"Analytic 1934","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) protocol message sequence placing a field device into firmware-update mode from a source not in the approved engineering workstation list, correlated with the device's alarm telemetry going silent within a short grace period without acknowledgment. Documented precedent: Industroyer exploited CVE-2015-5374 by sending a crafted packet that initiated an incomplete firmware update sequence on Siemens Protection Technology (SIPROTEC) relays. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0802#AN1934","platforms":["Embedded"],"tuning":[{"field":"AlarmSilenceGracePeriod","description":"Time window within which alarm telemetry going silent following a mode-change message is considered directly connected."},{"field":"AuthorizedFirmwareManagers","description":"Accounts authorized to perform firmware update mode activation."},{"field":"ChangeControlWindow","description":"Scheduled maintenance periods during which firmware update mode activation is authorized."},{"field":"EngineeringWorkstationList","description":"IP allowlist of workstations authorized to activate firmware update mode."},{"field":"MaintenanceWindowSchedule","description":"Recurring scheduled periods when firmware update activities are expected."}],"log_sources":[{"component_id":"DC0108","component":"Device Alarm","name":"operationaldb:AlarmEvent","channel":"device_ip alarm telemetry goes silent within alarm silence grace period of the mode-activation message without operator acknowledgment","platforms":["Embedded"],"analytic_id":"AN1934","source_url":"https://attack.mitre.org/detectionstrategies/DET0802#AN1934","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0108/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"firmware-update-mode activation service from source not in engineering workstation list outside change control window","platforms":["Embedded"],"analytic_id":"AN1934","source_url":"https://attack.mitre.org/detectionstrategies/DET0802#AN1934","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0038","component":"Application Log Content","name":"engineeringworkstation:ApplicationLog","channel":"firmware update mode entry logged without corresponding change ticket reference","platforms":["Embedded"],"analytic_id":"AN1934","source_url":"https://attack.mitre.org/detectionstrategies/DET0802#AN1934","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN2158","name":"Analytic 2158","guidance":"Real-time monitoring identifies a firmware update tool on an Industrial Control System (ICS) Linux engineering host initiating firmware-update mode activation outside a scheduled maintenance window, by a User Identifier (UID) not in the approved firmware manager UIDs. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0802#AN2158","platforms":["Linux"],"tuning":[{"field":"AlarmSilenceGracePeriod","description":"Time window within which alarm telemetry going silent following a mode-change message is considered directly connected."},{"field":"AuthorizedFirmwareManagers","description":"Accounts authorized to perform firmware update mode activation."},{"field":"ChangeControlWindow","description":"Scheduled maintenance periods during which firmware update mode activation is authorized."},{"field":"EngineeringWorkstationList","description":"IP allowlist of workstations authorized to activate firmware update mode."},{"field":"MaintenanceWindowSchedule","description":"Recurring scheduled periods when firmware update activities are expected."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=execve; firmware-update utility invoked outside the approved maintenance window or by a UID not in the authorized firmware-management set","platforms":["Linux"],"analytic_id":"AN2158","source_url":"https://attack.mitre.org/detectionstrategies/DET0802#AN2158","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN2179","name":"Analytic 2179","guidance":"Real-time monitoring identifies transfer protocol traffic such as the Trivial File Transfer Protocol (TFTP) or vendor-specific protocol traffic initiating firmware-update mode on Industrial Control System (ICS) device Internet Protocol (IP) addresses from sources not in the approved engineering workstation list. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0802#AN2179","platforms":["Network Devices"],"tuning":[{"field":"AlarmSilenceGracePeriod","description":"Time window within which alarm telemetry going silent following a mode-change message is considered directly connected."},{"field":"AuthorizedFirmwareManagers","description":"Accounts authorized to perform firmware update mode activation."},{"field":"ChangeControlWindow","description":"Scheduled maintenance periods during which firmware update mode activation is authorized."},{"field":"EngineeringWorkstationList","description":"IP allowlist of workstations authorized to activate firmware update mode."},{"field":"MaintenanceWindowSchedule","description":"Recurring scheduled periods when firmware update activities are expected."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"netflow:ipfix","channel":"IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): firmware-mode activation protocol session from source not in engineering workstation list","platforms":["Network Devices"],"analytic_id":"AN2179","source_url":"https://attack.mitre.org/detectionstrategies/DET0802#AN2179","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2282","name":"Analytic 2282","guidance":"Real-time monitoring identifies a vendor firmware update tool activating firmware-update mode on a field device from a Windows host, outside a scheduled maintenance window or by an account not in the approved firmware management role. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0802#AN2282","platforms":["Windows"],"tuning":[{"field":"AlarmSilenceGracePeriod","description":"Time window within which alarm telemetry going silent following a mode-change message is considered directly connected."},{"field":"AuthorizedFirmwareManagers","description":"Accounts authorized to perform firmware update mode activation."},{"field":"ChangeControlWindow","description":"Scheduled maintenance periods during which firmware update mode activation is authorized."},{"field":"EngineeringWorkstationList","description":"IP allowlist of workstations authorized to activate firmware update mode."},{"field":"MaintenanceWindowSchedule","description":"Recurring scheduled periods when firmware update activities are expected."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1 firmware update tool process activating firmware mode, by account not in authorized firmware managers, outside maintenance window schedule","platforms":["Windows"],"analytic_id":"AN2282","source_url":"https://attack.mitre.org/detectionstrategies/DET0802#AN2282","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0108","name":"Device Alarm","tag":"Device Alarm","page":"telemetry/DC0108/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"The [Industroyer](https://attack.mitre.org/software/S0604) SIPROTEC DoS module places the victim device into firmware update mode. This is a legitimate use case under normal circumstances, but in this case is used the adversary to prevent the SIPROTEC from performing its designed protective functions. As a result the normal safeguards are disabled, leaving an unprotected link in the electric transmission. (Citation: Joe Slowik August 2019)","relationship_id":"relationship--83c8c216-7ff7-4bd3-9db4-573469628d95","references":[{"source_name":"Joe Slowik August 2019","description":"Joe Slowik 2019, August 15 CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack Retrieved. 2019/10/22 ","url":"https://dragos.com/wp-content/uploads/CRASHOVERRIDE.pdf"}]}],"actors":[],"mitigations":[{"id":"M0800","name":"Authorization Enforcement","url":"https://attack.mitre.org/mitigations/M0800","kind":"course-of-action","description":"Restrict configurations changes and firmware updating abilities to only authorized individuals.\n","relationship_id":"relationship--ff3f0668-98df-44c1-88c2-711f05720eb8","references":[]},{"id":"M0801","name":"Access Management","url":"https://attack.mitre.org/mitigations/M0801","kind":"course-of-action","description":"All devices or systems changes, including all administrative functions, should require authentication. Consider using access management technologies to enforce authorization on all management interface access attempts, especially when the device does not inherently provide strong authentication and authorization functions.\n","relationship_id":"relationship--b3b24837-83ed-46c5-ba80-66a832c7072e","references":[]},{"id":"M0802","name":"Communication Authenticity","url":"https://attack.mitre.org/mitigations/M0802","kind":"course-of-action","description":"Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.\n","relationship_id":"relationship--afd63145-6033-49e4-ad43-d0b35fa5ed88","references":[]},{"id":"M0804","name":"Human User Authentication","url":"https://attack.mitre.org/mitigations/M0804","kind":"course-of-action","description":"Devices that allow remote management of firmware should require authentication before allowing any changes. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918)","relationship_id":"relationship--63453d2f-30f6-40ab-b32c-506d940ecd20","references":[]},{"id":"M0807","name":"Network Allowlists","url":"https://attack.mitre.org/mitigations/M0807","kind":"course-of-action","description":"Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. (Citation: Department of Homeland Security September 2016)\n","relationship_id":"relationship--10626671-941d-4a82-a835-56059058ef87","references":[{"source_name":"Department of Homeland Security September 2016","description":"Department of Homeland Security 2016, September Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"}]},{"id":"M0813","name":"Software Process and Device Authentication","url":"https://attack.mitre.org/mitigations/M0813","kind":"course-of-action","description":"Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.\n","relationship_id":"relationship--758d5818-f919-4a6b-9dc2-a212595a11bd","references":[]},{"id":"M0930","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M0930","kind":"course-of-action","description":"Segment operational network and systems to restrict access to critical system functions to predetermined management systems. (Citation: Department of Homeland Security September 2016)\n","relationship_id":"relationship--f15f24d2-e581-46ce-83e4-a924f572aae6","references":[{"source_name":"Department of Homeland Security September 2016","description":"Department of Homeland Security 2016, September Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"}]},{"id":"M0937","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M0937","kind":"course-of-action","description":"Filter for protocols and payloads associated with firmware activation or updating activity.\n","relationship_id":"relationship--ee89466e-0655-4217-844d-fb8ea4f76247","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0800":"/ttp-simulation/techniques/ics/T0800/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0800","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0108","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","alarm_code":"LAB_COMM_LOSS","severity":"warning","active":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}