{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0843","id":"T0843","name":"Program Download","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0843","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"e185de3881baa3ddbb2a25bdcd821c0916a67aff7e34c28c84c24a9764187ea2","description":"Adversaries may perform a program download to transfer a user program to a controller. \n\nVariations of program download, such as online edit and program append, allow a controller to continue running during the transfer and reconfiguration process without interruption to process control. However, before starting a full program download (i.e., download all) a controller may need to go into a stop state. This can have negative consequences on the physical process, especially if the controller is not able to fulfill a time-sensitive action. Adversaries may choose to avoid a download all in favor of an online edit or program append to avoid disrupting the physical process. An adversary may need to use the technique Detect Operating Mode or Change Operating Mode to make sure the controller is in the proper mode to accept a program download.\n\nThe granularity of control to transfer a user program in whole or parts is dictated by the management protocol (e.g., S7CommPlus, TriStation) and underlying controller API. Thus, program download is a high-level term for the suite of vendor-specific API calls used to configure a controllers user program memory space.  \n\n[Modify Controller Tasking](https://attack.mitre.org/techniques/T0821) and [Modify Program](https://attack.mitre.org/techniques/T0889) represent the configuration changes that are transferred to a controller via a program download.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0843","external_id":"T0843"}],"platforms":["Embedded"],"environments":["ics-ot"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"ics/T0843.001","id":"T0843.001","name":"Download All","page":"techniques/ics/T0843.001/"},{"key":"ics/T0843.002","id":"T0843.002","name":"Online Edit","page":"techniques/ics/T0843.002/"},{"key":"ics/T0843.003","id":"T0843.003","name":"Program Append","page":"techniques/ics/T0843.003/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0110","name":"Asset Inventory","page":"telemetry/DC0110/","kind":"attack_component","category":"Industrial operations and physical process","description":"Inventory of operational assets, identities, roles and network relationships.","collection_focus":"Prefer approved inventory exports and passive discovery; retain model, firmware, owner and observation source. Do not scan a production control network as a default collection step.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["asset_id","role","firmware","source"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0110","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","role":"PLC_fixture","firmware":"lab-1.0","source":"approved_inventory"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"attack_component","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."},{"id":"DC0108","name":"Device Alarm","page":"telemetry/DC0108/","kind":"attack_component","category":"Industrial operations and physical process","description":"Device-generated alarms about equipment or controller state.","collection_focus":"Subscribe to supported device alarm/audit channels; retain code, severity, source asset and acknowledgement/clear times.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["asset_id","alarm_code","severity","active"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0108","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","alarm_code":"LAB_COMM_LOSS","severity":"warning","active":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"attack_component","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"ics/T0843","id":"T0843","name":"Program Download","domain":"ics","platforms":["Embedded"],"environments":["ics-ot"],"source_url":"https://attack.mitre.org/techniques/T0843","technique_page":"techniques/ics/T0843/","page":"detections/ics/T0843/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0752","name":"Detection of Program Download","url":"https://attack.mitre.org/detectionstrategies/DET0752","stix_id":"x-mitre-detection-strategy--709e05b2-6400-43a2-9bbf-b64f6017b023","relationship_id":"relationship--14178a60-b894-4186-b83b-5ffd043f4cfc","description":"","analytics":[{"id":"AN1884","name":"Analytic 1884","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) protocol session consistent with a program download to a field device from a source not in the approved engineering workstation list, correlated with a device mode-change alarm transitioning to PROGRAM/STOP immediately preceding the transfer. Documented in Stuxnet (code/data block download to alter programmable logic controller behavior) and Triton (TriStation protocol program download to the Triconex Safety Instrumented System). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0752#AN1884","platforms":["Embedded"],"tuning":[{"field":"ChangeControlWindow","description":"Scheduled maintenance periods during which program downloads are authorized."},{"field":"EngineeringWorkstationList","description":"IP allowlist of workstations authorized to perform program downloads."},{"field":"ModeChangeToDownloadWindow","description":"Time window within which a mode-change event and subsequent download session are considered the same engineering action."},{"field":"ProgramDownloadSizeThreshold","description":"Minimum byte count distinguishing a full program download from routine traffic."}],"log_sources":[{"component_id":"DC0110","component":"Asset Inventory","name":"assetinventory:ProgramHash","channel":"post-transfer program hash does not match last authorized program baseline","platforms":["Embedded"],"analytic_id":"AN1884","source_url":"https://attack.mitre.org/detectionstrategies/DET0752#AN1884","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0110/"},{"component_id":"DC0108","component":"Device Alarm","name":"operationaldb:AlarmEvent","channel":"device_ip transitions to PROGRAM/STOP mode without operator_ack and without corresponding open change ticket reference","platforms":["Embedded"],"analytic_id":"AN1884","source_url":"https://attack.mitre.org/detectionstrategies/DET0752#AN1884","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0108/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"S7comm Download Block / Common Industrial Protocol (CIP) Download Program / Distributed Network Protocol (DNP3) program file transfer to device_ip from source not in engineering workstation list within mode change to download window of mode-change event","platforms":["Embedded"],"analytic_id":"AN1884","source_url":"https://attack.mitre.org/detectionstrategies/DET0752#AN1884","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0038","component":"Application Log Content","name":"engineeringworkstation:ApplicationLog","channel":"program download session logged without corresponding change ticket reference","platforms":["Embedded"],"analytic_id":"AN1884","source_url":"https://attack.mitre.org/detectionstrategies/DET0752#AN1884","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0110","name":"Asset Inventory","tag":"Asset Inventory","page":"telemetry/DC0110/","kind":"attack_component"},{"id":"DC0108","name":"Device Alarm","tag":"Device Alarm","page":"telemetry/DC0108/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603)'s infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--7c893581-c847-495a-aa93-9d98c516e1ae","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S1006","name":"PLC-Blaster","url":"https://attack.mitre.org/software/S1006","kind":"malware","description":"[PLC-Blaster](https://attack.mitre.org/software/S1006) utilizes the PLC communication and management API to load executable Program Organization Units. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)","relationship_id":"relationship--31897c41-1d47-4a34-b531-21c3f74651a8","references":[{"source_name":"Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016","description":"Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ","url":"https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"}]},{"id":"S1009","name":"Triton","url":"https://attack.mitre.org/software/S1009","kind":"malware","description":"[Triton](https://attack.mitre.org/software/S1009) leveraged the TriStation protocol to download programs onto Triconex Safety Instrumented System.(Citation: Jos Wetzels January 2018)","relationship_id":"relationship--1f8abf6f-0dd0-4449-b555-733fe7296177","references":[{"source_name":"Jos Wetzels January 2018","description":"Jos Wetzels 2018, January 16 Analyzing the TRITON industrial malware Retrieved. 2019/10/22 ","url":"https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"}]},{"id":"S1045","name":"INCONTROLLER","url":"https://attack.mitre.org/software/S1045","kind":"malware","description":"[INCONTROLLER](https://attack.mitre.org/software/S1045) has used the CODESYS protocol to download programs to Schneider PLCs.(Citation: Wylie-22)(Citation: Brubaker-Incontroller) [INCONTROLLER](https://attack.mitre.org/software/S1045) has also modified program logic on Omron PLCs using either the program download or backup transfer functions available through the HTTP server.(Citation: Wylie-22) ","relationship_id":"relationship--7c1eee62-3307-4e25-8a20-919ccd56ec1c","references":[{"source_name":"Wylie-22","description":"Jimmy Wylie. (2022, August). Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit. Defcon 30.","url":"https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Jimmy%20Wylie%20-%20Analyzing%20PIPEDREAM%20Challenges%20in%20testing%20an%20ICS%20attack%20toolkit.pdf"},{"source_name":"Brubaker-Incontroller","description":"Nathan Brubaker, Keith Lunden, Ken Proska, Muhammad Umair, Daniel Kapellmann Zafra, Corey Hildebrandt, Rob Caldwell. (2022, April 13). INCONTROLLER: New State-Sponsored Cyber Attack Tools Target Multiple Industrial Control Systems. Retrieved September 28, 2022.","url":"https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool"}]}],"actors":[{"id":"G1027","name":"CyberAv3ngers","url":"https://attack.mitre.org/groups/G1027","kind":"intrusion-set","description":"During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) used the manufacturers’ commercial PLC programming software to push new configurations to victim hardware. These include Rockwell Automation’s [Studio Logix 5000 Designer](https://attack.mitre.org/software/S9054), Schneider Electric’s [EcoStruxure Control Expert](https://attack.mitre.org/software/S9056), and Siemens’ [Totally Integrated Automation (TIA) Portal](https://attack.mitre.org/software/S9055). In these changes, adversaries deleted program logic, removed Add-On Instructions (AOIs) and manipulated alarm logic and HMI screens.(Citation: CISA-AA26-097A)","relationship_id":"relationship--388df1cd-3e92-4eee-ac0f-6d8b824cd42f","references":[{"source_name":"CISA-AA26-097A","description":"Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"}]}],"mitigations":[{"id":"M0800","name":"Authorization Enforcement","url":"https://attack.mitre.org/mitigations/M0800","kind":"course-of-action","description":"All field controllers should restrict the download of programs, including online edits and program appends, to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.\n","relationship_id":"relationship--a7caa7f2-cfb9-4fc9-ae8d-49349b6c260f","references":[]},{"id":"M0801","name":"Access Management","url":"https://attack.mitre.org/mitigations/M0801","kind":"course-of-action","description":"Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.\n","relationship_id":"relationship--ec105f62-2552-41fa-8b07-619dc1bf9b19","references":[]},{"id":"M0802","name":"Communication Authenticity","url":"https://attack.mitre.org/mitigations/M0802","kind":"course-of-action","description":"Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.\n","relationship_id":"relationship--ebc34374-2dee-4dc1-b0b7-f31ae94dab11","references":[]},{"id":"M0804","name":"Human User Authentication","url":"https://attack.mitre.org/mitigations/M0804","kind":"course-of-action","description":"All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).","relationship_id":"relationship--fa1bde35-63d9-4c5c-969b-2c17c29089fa","references":[]},{"id":"M0807","name":"Network Allowlists","url":"https://attack.mitre.org/mitigations/M0807","kind":"course-of-action","description":"Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)\n","relationship_id":"relationship--4256a0c2-437d-4a4c-88ac-d08d3041b8c1","references":[{"source_name":"Department of Homeland Security September 2016","description":"Department of Homeland Security 2016, September Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"}]},{"id":"M0813","name":"Software Process and Device Authentication","url":"https://attack.mitre.org/mitigations/M0813","kind":"course-of-action","description":"Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.\n","relationship_id":"relationship--028a3bcc-f299-4061-a0f2-8da85e0a3c81","references":[]},{"id":"M0930","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M0930","kind":"course-of-action","description":"Segment operational network and systems to restrict access to critical system functions to predetermined management systems.(Citation: Department of Homeland Security September 2016)\n","relationship_id":"relationship--8fcecf74-36df-41ab-9476-539c9ac0b339","references":[{"source_name":"Department of Homeland Security September 2016","description":"Department of Homeland Security 2016, September Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"}]},{"id":"M0937","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M0937","kind":"course-of-action","description":"Filter for protocols and payloads associated with program download activity to prevent unauthorized device configurations.\n","relationship_id":"relationship--366a4cd1-aa95-4985-9d80-b45a2551e298","references":[]},{"id":"M0945","name":"Code Signing","url":"https://attack.mitre.org/mitigations/M0945","kind":"course-of-action","description":"Utilize code signatures to verify the integrity and authenticity of programs downloaded to the device.\n","relationship_id":"relationship--cb30d507-edc6-4197-947c-7b3a6e395c0d","references":[]},{"id":"M0947","name":"Audit","url":"https://attack.mitre.org/mitigations/M0947","kind":"course-of-action","description":"Provide the ability to verify the integrity of programs downloaded on a controller. While techniques like CRCs and checksums are commonly used, they are not cryptographically secure and can be vulnerable to collisions. Preferably cryptographic hash functions (e.g., SHA-2, SHA-3) should be used.(Citation: IEC February 2019)\n","relationship_id":"relationship--1c3d966a-5995-48ed-919d-25b972010fe9","references":[{"source_name":"IEC February 2019","description":"IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ","url":"https://webstore.iec.ch/publication/34421"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0821":"/ttp-simulation/techniques/ics/T0821/","T0889":"/ttp-simulation/techniques/ics/T0889/","T0843":"/ttp-simulation/techniques/ics/T0843/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0843","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0110","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","role":"PLC_fixture","firmware":"lab-1.0","source":"approved_inventory"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0108","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","alarm_code":"LAB_COMM_LOSS","severity":"warning","active":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}}]}}