{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0862","id":"T0862","name":"Supply Chain Compromise","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0862","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"0b39703ae1a00cd1e334d5380146c76da8fd627322f8101e6f3fffaffaf70b5e","description":"Adversaries may perform supply chain compromise to gain control systems environment access by means of infected products, software, and workflows. Supply chain compromise is the manipulation of products, such as devices or software, or their delivery mechanisms before receipt by the end consumer. Adversary compromise of these products and mechanisms is done for the goal of data or system compromise, once infected products are introduced to the target environment. \n\nSupply chain compromise can occur at all stages of the supply chain, from manipulation of development tools and environments to manipulation of developed products and tools distribution mechanisms. This may involve the compromise and replacement of legitimate software and patches, such as on third party or vendor websites. Targeting of supply chain compromise can be done in attempts to infiltrate the environments of a specific audience. In control systems environments with assets in both the IT and OT networks, it is possible a supply chain compromise affecting the IT environment could enable further access to the OT environment.   \n\nCounterfeit devices may be introduced to the global supply chain posing safety and cyber risks to asset owners and operators. These devices may not meet the safety, engineering and manufacturing requirements of regulatory bodies but may feature tagging indicating conformance with industry standards. Due to the lack of adherence to standards and overall lesser quality, the counterfeit products may pose a serious safety and operational risk. (Citation: Control Global May 2019) \n\nYokogawa identified instances in which their customers received counterfeit differential pressure transmitters using the Yokogawa logo. The counterfeit transmitters were nearly indistinguishable with a semblance of functionality and interface that mimics the genuine product. (Citation: Control Global May 2019) \n\nF-Secure Labs analyzed the approach the adversary used to compromise victim systems with Havex. (Citation: Daavid Hentunen, Antti Tikkanen June 2014) The adversary planted trojanized software installers available on legitimate ICS/SCADA vendor websites. After being downloaded, this software infected the host computer with a Remote Access Trojan (RAT).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0862","external_id":"T0862"},{"source_name":"Control Global May 2019","description":"Control Global 2019, May 29 Yokogawa announcement warns of counterfeit transmitters Retrieved. 2021/04/09 ","url":"https://www.controlglobal.com/industrynews/2019/yokogawa-announcement-warns-of-counterfeit-transmitters/"},{"source_name":"Daavid Hentunen, Antti Tikkanen June 2014","description":"Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 ","url":"https://www.f-secure.com/weblog/archives/00002718.html"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0059","name":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component","category":"Host state and inventory","description":"File attributes such as path, size, timestamps, ownership and cryptographic hash.","collection_focus":"Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["path","size_bytes","sha256","owner_uid"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0004","name":"Firmware Modification","page":"telemetry/DC0004/","kind":"attack_component","category":"Host state and inventory","description":"Changes to firmware state or a firmware update observation on a device.","collection_focus":"Collect approved OEM firmware inventory/update audit and compare version or measured hashes against a known baseline. Use read-only vendor-supported interfaces.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["asset_id","firmware_before","firmware_after","change_ticket"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0004","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-device-1","firmware_before":"1.0-lab","firmware_after":"1.1-lab","change_ticket":"LAB-42"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."}],"detection":{"key":"ics/T0862","id":"T0862","name":"Supply Chain Compromise","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0862","technique_page":"techniques/ics/T0862/","page":"detections/ics/T0862/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0730","name":"Detection of Supply Chain Compromise","url":"https://attack.mitre.org/detectionstrategies/DET0730","stix_id":"x-mitre-detection-strategy--58b4bda4-d69a-4a20-ab67-308c4451a5e8","relationship_id":"relationship--9bb98efc-3712-4df3-a1a4-8dfefd2983fa","description":"","analytics":[{"id":"AN1863","name":"Analytic 1863","guidance":"Real-time monitoring identifies a vendor-distributed software update package that, upon execution, exhibits behavior inconsistent with the vendor's documented installation profile: spawning unexpected child processes, writing files outside the vendor's standard manifest, or loading unsigned Dynamic Link Libraries (DLLs). OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0730#AN1863","platforms":["Windows"],"tuning":[{"field":"VendorInstallManifest","description":"Documented list of files/registry keys a legitimate vendor installer is expected to create."},{"field":"VendorInstallProfile","description":"Documented expected process behavior for a legitimate vendor installer, established through lab testing."}],"log_sources":[{"component_id":"DC0059","component":"File Metadata","name":"fim:hashcompare","channel":"installed binary hash does not match vendor-published checksum for claimed version","platforms":["Windows"],"analytic_id":"AN1863","source_url":"https://attack.mitre.org/detectionstrategies/DET0730#AN1863","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"},{"component_id":"DC0059","component":"File Metadata","name":"WinEventLog:Sysmon","channel":"Microsoft-Windows-Sysmon/Operational Event ID 11 FileCreate/overwrite or Event ID 2 FileCreateTime, as applicable: Process creation and file creation correlation: vendor installer creates files outside vendor install manifest or spawns undocumented child process","platforms":["Windows"],"analytic_id":"AN1863","source_url":"https://attack.mitre.org/detectionstrategies/DET0730#AN1863","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"}]},{"id":"AN2109","name":"Analytic 2109","guidance":"Periodic or event-triggered integrity verification identifies field devices with firmware or configuration that differs from the vendor-published authorized baseline, detected by comparing device firmware hashes against the authorized firmware inventory, appearing immediately after a vendor-supplied update or hardware replacement. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Monitoring reality: this is an integrity/posture analytic, not a universal streaming field-device event; collection cadence depends on the vendor integrity interface, asset-management system, or acquisition workflow.","url":"https://attack.mitre.org/detectionstrategies/DET0730#AN2109","platforms":["Embedded"],"tuning":[{"field":"VendorInstallManifest","description":"Documented list of files/registry keys a legitimate vendor installer is expected to create."},{"field":"VendorInstallProfile","description":"Documented expected process behavior for a legitimate vendor installer, established through lab testing."}],"log_sources":[{"component_id":"DC0004","component":"Firmware Modification","name":"assetinventory:FirmwareHash","channel":"post-update firmware hash does not match vendor-published checksum for the claimed version","platforms":["Embedded"],"analytic_id":"AN2109","source_url":"https://attack.mitre.org/detectionstrategies/DET0730#AN2109","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0004/"}]},{"id":"AN2111","name":"Analytic 2111","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) vendor software package whose installation, via package manager, creates unexpected files or starts unrecognized services not documented in the vendor's package manifest. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0730#AN2111","platforms":["Linux"],"tuning":[{"field":"VendorInstallManifest","description":"Documented list of files/registry keys a legitimate vendor installer is expected to create."},{"field":"VendorInstallProfile","description":"Documented expected process behavior for a legitimate vendor installer, established through lab testing."}],"log_sources":[{"component_id":"DC0059","component":"File Metadata","name":"auditd:SYSCALL+PATH","channel":"Linux Audit SYSCALL+PATH records: package installation creates files outside the documented package manifest","platforms":["Linux"],"analytic_id":"AN2111","source_url":"https://attack.mitre.org/detectionstrategies/DET0730#AN2111","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"}]},{"id":"AN2189","name":"Analytic 2189","guidance":"Real-time monitoring identifies a network infrastructure device exhibiting behavioral anomalies (unexpected listening ports, new routing entries) after a vendor firmware update or hardware replacement, where the device firmware hash does not match the authorized inventory. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0730#AN2189","platforms":["Network Devices"],"tuning":[{"field":"VendorInstallManifest","description":"Documented list of files/registry keys a legitimate vendor installer is expected to create."},{"field":"VendorInstallProfile","description":"Documented expected process behavior for a legitimate vendor installer, established through lab testing."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"networkdevice:syslog","channel":"unexpected listening port or routing table change following firmware update event","platforms":["Network Devices"],"analytic_id":"AN2189","source_url":"https://attack.mitre.org/detectionstrategies/DET0730#AN2189","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0059","name":"File Metadata","tag":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component"},{"id":"DC0004","name":"Firmware Modification","tag":"Firmware Modification","page":"telemetry/DC0004/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0093","name":"Backdoor.Oldrea","url":"https://attack.mitre.org/software/S0093","kind":"malware","description":"The [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) RAT is distributed through trojanized installers planted on compromised vendor sites. (Citation: Daavid Hentunen, Antti Tikkanen June 2014)","relationship_id":"relationship--6d822f86-5793-403a-b176-5d533f6b81b3","references":[{"source_name":"Daavid Hentunen, Antti Tikkanen June 2014","description":"Daavid Hentunen, Antti Tikkanen 2014, June 23 Havex Hunts For ICS/SCADA Systems Retrieved. 2019/04/01 ","url":"https://www.f-secure.com/weblog/archives/00002718.html"}]}],"actors":[{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) trojanized legitimate ICS equipment providers software packages available for download on their websites.(Citation: Symantec Security Response July 2014)","relationship_id":"relationship--ef615d62-fe85-4740-9c5d-5dddff9b5693","references":[{"source_name":"Symantec Security Response July 2014","description":"Symantec Security Response 2014, July 7 Dragonfly: Cyberespionage Attacks Against Energy Suppliers Retrieved. 2016/04/08 ","url":"https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers#:~:text=The%20attackers%2C%20known%20to%20Symantec,supply%20in%20the%20affected%20countries."}]},{"id":"G0088","name":"TEMP.Veles","url":"https://attack.mitre.org/groups/G0088","kind":"intrusion-set","description":"[TEMP.Veles](https://attack.mitre.org/groups/G0088) targeted several ICS vendors and manufacturers. (Citation: Dragos Threat Intelligence August 2019)","relationship_id":"relationship--b343e131-e448-46c6-815b-b86e4bd6d638","references":[{"source_name":"Dragos Threat Intelligence August 2019","description":"Dragos Threat Intelligence 2019, August Global Oil and Gas Cyber Threat Perspective Retrieved. 2020/01/03 ","url":"https://dragos.com/wp-content/uploads/Dragos-Oil-and-Gas-Threat-Perspective-2019.pdf"}]}],"mitigations":[{"id":"M0817","name":"Supply Chain Management","url":"https://attack.mitre.org/mitigations/M0817","kind":"course-of-action","description":"A supply chain management program should include methods the assess the trustworthiness and technical maturity of a supplier, along with technical methods (e.g., code-signing, bill of materials) needed to validate the integrity of newly obtained devices and components. Develop procurement language that emphasizes the expectations for suppliers regarding the artifacts, audit records, and technical capabilities needed to validate the integrity of the devices supply chain. (Citation: Robert A. Martin January 2021)\n","relationship_id":"relationship--c8a40335-90d6-496a-b4f9-1cc93d3fffc6","references":[{"source_name":"Robert A. Martin January 2021","description":"Robert A. Martin 2021, January TRUSTING OUR SUPPLY CHAINS: A COMPREHENSIVE DATA-DRIVEN APPROACH Retrieved. 2021/04/12 ","url":"https://www.mitre.org/sites/default/files/publications/pr-20-01465-37-trusting-our-supply-chains-a-comprehensive-data-driven-approach.pdf"}]},{"id":"M0916","name":"Vulnerability Scanning","url":"https://attack.mitre.org/mitigations/M0916","kind":"course-of-action","description":"Implement continuous monitoring of vulnerability sources. Also, use automatic and manual code review tools. (Citation: OWASP)\n","relationship_id":"relationship--c67e3535-69a9-4234-8170-4ad6efc632b7","references":[{"source_name":"OWASP","description":"OWASP   Top 10 Web Application Security Risks Retrieved. 2020/09/25 ","url":"https://owasp.org/www-project-top-ten/"}]},{"id":"M0945","name":"Code Signing","url":"https://attack.mitre.org/mitigations/M0945","kind":"course-of-action","description":"When available utilize hardware and software root-of-trust to verify the authenticity of a system. This may be achieved through cryptographic means, such as digital signatures or hashes, of critical software and firmware throughout the supply chain.\n","relationship_id":"relationship--d6a2a1a8-8f5b-4e94-8fce-8edd8a17627a","references":[]},{"id":"M0947","name":"Audit","url":"https://attack.mitre.org/mitigations/M0947","kind":"course-of-action","description":"Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses. Perform periodic integrity checks of the device to validate the correctness of the firmware, software, programs, and configurations. Integrity checks, which typically include cryptographic hashes or digital signatures, should be compared to those obtained at known valid states, especially after events like device reboots, program downloads, or program restarts.\n","relationship_id":"relationship--0491ef92-2941-4841-9fe6-2e1809788b52","references":[]},{"id":"M0951","name":"Update Software","url":"https://attack.mitre.org/mitigations/M0951","kind":"course-of-action","description":"A patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.\n","relationship_id":"relationship--03d44496-7a15-4e23-820f-b6f1079dbbd3","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0862":"/ttp-simulation/techniques/ics/T0862/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0862","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0004","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-device-1","firmware_before":"1.0-lab","firmware_after":"1.1-lab","change_ticket":"LAB-42"}}]}}