{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0836","id":"T0836","name":"Modify Parameter","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0836","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"692bc0fa33813f259d9675a82bfb0bb77d61c8cf166a170fade78fa391a8cbce","description":"Adversaries may modify parameters used to instruct industrial control system devices. These devices operate via programs that dictate how and when to perform actions based on such parameters. Such parameters can determine the extent to which an action is performed and may specify additional options. For example, a program on a control system device dictating motor processes may take a parameter defining the total number of seconds to run that motor.      \n\nAn adversary can potentially modify these parameters to produce an outcome outside of what was intended by the operators. By modifying system and process critical parameters, the adversary may cause [Impact](https://attack.mitre.org/tactics/TA0105) to equipment and/or control processes. Modified parameters may be turned into dangerous, out-of-bounds, or unexpected values from typical operations. For example, specifying that a process run for more or less time than it should, or dictating an unusually high, low, or invalid value as a parameter.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0836","external_id":"T0836"}],"platforms":["Embedded","Windows","Linux"],"environments":["cloud-hosted-endpoint","ics-ot","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0107","name":"Process History/Live Data","page":"telemetry/DC0107/","kind":"attack_component","category":"Industrial operations and physical process","description":"Time-series measurements of an industrial process, including historical and live values.","collection_focus":"Export historian/process tags with engineering units, quality and source timestamps; define expected sample rate and compare an independent signal.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["tag","value","unit","quality"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0107","collector":"illustrative-lab-collector","observation":{"tag":"LAB.TankLevel","value":42,"unit":"percent","quality":"good"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"attack_component","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."}],"detection":{"key":"ics/T0836","id":"T0836","name":"Modify Parameter","domain":"ics","platforms":["Embedded","Windows","Linux"],"environments":["cloud-hosted-endpoint","ics-ot","onprem"],"source_url":"https://attack.mitre.org/techniques/T0836","technique_page":"techniques/ics/T0836/","page":"detections/ics/T0836/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0776","name":"Detection of Modify Parameter","url":"https://attack.mitre.org/detectionstrategies/DET0776","stix_id":"x-mitre-detection-strategy--442e5dcf-7f41-4ba5-ba89-aefb0d1c63cf","relationship_id":"relationship--af5a7b69-9519-436e-bb58-049b08d82809","description":"","analytics":[{"id":"AN1908","name":"Analytic 1908","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) protocol write to a parameter/setpoint register where the written value falls outside the documented safe operating range, or where the write originates from a source not in the approved write-source list, correlated with subsequent historian tag drift. Documented precedent: FrostyGoop directly modified Modbus holding register values on ENCO heating controllers in Lviv, Ukraine, causing a two-day remediation outage. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0776#AN1908","platforms":["Embedded"],"tuning":[{"field":"ApprovedWriteSources","description":"IP allowlist of sources authorized to write to parameter/setpoint registers."},{"field":"BaselineValueRange","description":"Documented safe operating range for each monitored parameter."},{"field":"ParameterDriftThreshold","description":"Percentage deviation from rolling baseline considered significant drift."},{"field":"SetpointAddressRange","description":"Register/address ranges corresponding to parameter and setpoint values for the device type."},{"field":"TimeWindow","description":"Time window over which post-write drift is measured."}],"log_sources":[{"component_id":"DC0107","component":"Process History/Live Data","name":"operationaldb:ProcessHistory","channel":"tag value deviates from rolling baseline mean by more than parameter drift threshold percent within time window following a flagged write","platforms":["Embedded"],"analytic_id":"AN1908","source_url":"https://attack.mitre.org/detectionstrategies/DET0776#AN1908","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0107/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"write function code (FC 6/16) to setpoint address range with value outside baseline value range, or from source not in approved write sources","platforms":["Embedded"],"analytic_id":"AN1908","source_url":"https://attack.mitre.org/detectionstrategies/DET0776#AN1908","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0038","component":"Application Log Content","name":"scada:applog","channel":"parameter write logged without corresponding operator_id in the Human-Machine Interface (HMI) audit trail","platforms":["Embedded"],"analytic_id":"AN1908","source_url":"https://attack.mitre.org/detectionstrategies/DET0776#AN1908","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN2145","name":"Analytic 2145","guidance":"Real-time monitoring identifies a Linux process invoking Industrial Control System (ICS) vendor write Application Programming Interfaces (APIs) or Open Platform Communications (OPC) Unified Architecture (UA) write calls to setpoint tags on field devices, from a User Identifier (UID) not associated with the authorized control application, with values exceeding the safe operating range. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0776#AN2145","platforms":["Linux"],"tuning":[{"field":"ApprovedWriteSources","description":"IP allowlist of sources authorized to write to parameter/setpoint registers."},{"field":"BaselineValueRange","description":"Documented safe operating range for each monitored parameter."},{"field":"ParameterDriftThreshold","description":"Percentage deviation from rolling baseline considered significant drift."},{"field":"SetpointAddressRange","description":"Register/address ranges corresponding to parameter and setpoint values for the device type."},{"field":"TimeWindow","description":"Time window over which post-write drift is measured."}],"log_sources":[{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"decoded ICS protocol write/setpoint operation to a control/output address from a client identity or source not in the approved control-application baseline","platforms":["Linux"],"analytic_id":"AN2145","source_url":"https://attack.mitre.org/detectionstrategies/DET0776#AN2145","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]},{"id":"AN2209","name":"Analytic 2209","guidance":"Real-time monitoring identifies a process on an Industrial Control System (ICS) Windows host writing setpoint values to Open Platform Communications (OPC) Data Access (DA)/Unified Architecture (UA) tags or historian writable tags without being the recognized Supervisory Control and Data Acquisition (SCADA) or Distributed Control System (DCS) control application, with values falling outside the normal operating range. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0776#AN2209","platforms":["Windows"],"tuning":[{"field":"ApprovedWriteSources","description":"IP allowlist of sources authorized to write to parameter/setpoint registers."},{"field":"BaselineValueRange","description":"Documented safe operating range for each monitored parameter."},{"field":"ParameterDriftThreshold","description":"Percentage deviation from rolling baseline considered significant drift."},{"field":"SetpointAddressRange","description":"Register/address ranges corresponding to parameter and setpoint values for the device type."},{"field":"TimeWindow","description":"Time window over which post-write drift is measured."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"opc:applog","channel":"write to setpoint tag from client not in approved Open Platform Communications (OPC) clients with value outside baseline value range","platforms":["Windows"],"analytic_id":"AN2209","source_url":"https://attack.mitre.org/detectionstrategies/DET0776#AN2209","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0107","name":"Process History/Live Data","tag":"Process History/Live Data","page":"telemetry/DC0107/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"In states 3 and 4 [Stuxnet](https://attack.mitre.org/software/S0603) sends two network bursts (done through the DP_SEND primitive). The data in the frames are instructions for the frequency converter drives. For example one of the frames contains records that change the maximum frequency (the speed at which the motor will operate). The frequency converter drives consist of parameters, which can be remotely configured via Profibus. One can write new values to these parameters changing the behavior of the device. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--50b3247a-ea71-455e-b299-f00666c05146","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S1045","name":"INCONTROLLER","url":"https://attack.mitre.org/software/S1045","kind":"malware","description":"[INCONTROLLER](https://attack.mitre.org/software/S1045) can use the HTTP CGI scripts on Omron PLCs to modify parameters on EtherCat connected servo drives.(Citation: Wylie-22) ","relationship_id":"relationship--4dd93fd2-6e6d-4c50-a091-6d6ea6903f1e","references":[{"source_name":"Wylie-22","description":"Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.","url":"https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"}]},{"id":"S1072","name":"Industroyer2","url":"https://attack.mitre.org/software/S1072","kind":"malware","description":"[Industroyer2](https://attack.mitre.org/software/S1072) modifies specified Information Object Addresses (IOAs) for specified Application Service Data Unit (ASDU) addresses to either the ON or OFF state.(Citation: Industroyer2 Mandiant April 2022)(Citation: Industroyer2 Forescout July 2022)","relationship_id":"relationship--665587ee-1524-4334-9580-2b448c417542","references":[{"source_name":"Industroyer2 Mandiant April 2022","description":"Daniel Kapellmann Zafra, Raymond Leong, Chris Sistrunk, Ken Proska, Corey Hildebrandt, Keith Lunden, Nathan Brubaker. (2022, April 25). INDUSTROYER.V2: Old Malware Learns New Tricks. Retrieved March 30, 2023.","url":"https://www.mandiant.com/resources/blog/industroyer-v2-old-malware-new-tricks"},{"source_name":"Industroyer2 Forescout July 2022","description":"Forescout. (2022, July 14). Industroyer2 and  INCONTROLLER In-depth Technical Analysis of the Most Recent ICS-specific Malware. Retrieved March 30, 2023.","url":"https://www.forescout.com/resources/industroyer2-and-incontroller-report/"}]},{"id":"S1165","name":"FrostyGoop","url":"https://attack.mitre.org/software/S1165","kind":"malware","description":"[FrostyGoop](https://attack.mitre.org/software/S1165) allows for the modification of system settings by reading and writing to registers via Modbus commands.(Citation: Dragos FROSTYGOOP 2024)(Citation: Nozomi BUSTLEBERM 2024)","relationship_id":"relationship--0d563cbc-b22c-4748-b082-db98bb7f0dab","references":[{"source_name":"Dragos FROSTYGOOP 2024","description":"Mark Graham, Carolyn Ahlers, Kyle O'Meara; Dragos. (2024, July). Impact of FrostyGoop ICS Malware on Connected OT Systems. Retrieved November 20, 2024.","url":"https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf"},{"source_name":"Nozomi BUSTLEBERM 2024","description":"Nozomi Networks Labs. (2024, July 24). Cyberwarfare Targeting OT: Protecting Against FrostyGoop/BUSTLEBERM Malware. Retrieved November 20, 2024.","url":"https://www.nozominetworks.com/blog/protecting-against-frostygoop-bustleberm-malware"}]}],"actors":[],"mitigations":[{"id":"M0800","name":"Authorization Enforcement","url":"https://attack.mitre.org/mitigations/M0800","kind":"course-of-action","description":"All field controllers should restrict the modification of parameter values to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism. They should also restrict online edits and enable write protection for parameters. \n","relationship_id":"relationship--e6be2fb4-3815-4e52-8dec-2aed1dc3b7cf","references":[]},{"id":"M0804","name":"Human User Authentication","url":"https://attack.mitre.org/mitigations/M0804","kind":"course-of-action","description":"All field controllers should require that user authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.","relationship_id":"relationship--af20f409-05ed-42c3-ae3e-09b047b84875","references":[]},{"id":"M0818","name":"Validate Program Inputs","url":"https://attack.mitre.org/mitigations/M0818","kind":"course-of-action","description":"Devices and programs should validate the content of any remote parameter changes, including those from HMIs, control servers, or engineering workstations.(Citation: PLCTop20 Mar 2023)","relationship_id":"relationship--f86bde61-c4ec-4d40-9768-32e9b52c1702","references":[{"source_name":"PLCTop20 Mar 2023","description":"PLC Security, Top 20 Community. (2021, June 15). Secure PLC Coding Practices: Top 20 version 1.0. Retrieved March 22, 2023.","url":"https://plc-security.com/content/Top_20_Secure_PLC_Coding_Practices_V1.0.pdf"}]},{"id":"M0947","name":"Audit","url":"https://attack.mitre.org/mitigations/M0947","kind":"course-of-action","description":"Provide the ability to verify the integrity and authenticity of changes to parameter values.\n","relationship_id":"relationship--5bf8473c-3c60-4a8a-8514-c2b50ab8a92d","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0836":"/ttp-simulation/techniques/ics/T0836/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0836","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0107","collector":"illustrative-lab-collector","observation":{"tag":"LAB.TankLevel","value":42,"unit":"percent","quality":"good"}}]}}