{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0889","id":"T0889","name":"Modify Program","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0889","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"a517be622987a16b6544004c8551229c865a2e52fd66695679a35680f19b67d9","description":"Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network. Modification to controller programs can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append. \n\nProgram modification encompasses the addition and modification of instructions and logic contained in Program Organization Units (POU)  (Citation: IEC February 2013) and similar programming elements found on controllers. This can include, for example, adding new functions to a controller, modifying the logic in existing functions and making new calls from one function to another. \n\nSome programs may allow an adversary to interact directly with the native API of the controller to take advantage of obscure features or vulnerabilities.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0889","external_id":"T0889"},{"source_name":"IEC February 2013","description":"IEC 2013, February 20 IEC 61131-3:2013  Programmable controllers - Part 3: Programming languages Retrieved. 2019/10/22 ","url":"https://webstore.iec.ch/publication/4552"}],"platforms":["Embedded"],"environments":["ics-ot"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0108","name":"Device Alarm","page":"telemetry/DC0108/","kind":"attack_component","category":"Industrial operations and physical process","description":"Device-generated alarms about equipment or controller state.","collection_focus":"Subscribe to supported device alarm/audit channels; retain code, severity, source asset and acknowledgement/clear times.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["asset_id","alarm_code","severity","active"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0108","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","alarm_code":"LAB_COMM_LOSS","severity":"warning","active":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"attack_component","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0111","name":"Software","page":"telemetry/DC0111/","kind":"attack_component","category":"Industrial operations and physical process","description":"Current and expected software, versions, patch levels and identifying artifacts on operational devices.","collection_focus":"Collect approved engineering/asset-management software inventories and compare with the expected baseline; retain device, product, version and hash/signature provenance.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["asset_id","software","version","expected_version","sha256"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0111","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-engineering-1","software":"Lab HMI runtime","version":"1.0-lab","expected_version":"1.0-lab","sha256":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"attack_component","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."}],"detection":{"key":"ics/T0889","id":"T0889","name":"Modify Program","domain":"ics","platforms":["Embedded"],"environments":["ics-ot"],"source_url":"https://attack.mitre.org/techniques/T0889","technique_page":"techniques/ics/T0889/","page":"detections/ics/T0889/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0783","name":"Detection of Modify Program","url":"https://attack.mitre.org/detectionstrategies/DET0783","stix_id":"x-mitre-detection-strategy--7f41ed29-fdc6-4c28-ba10-9de1aa129f7e","relationship_id":"relationship--faa5ba6b-bbc4-47ab-a737-6dc1d8b31efd","description":"","analytics":[{"id":"AN1915","name":"Analytic 1915","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) protocol write to an existing program block from a source not in the approved engineering workstation list, outside a scheduled change-control window, correlated against post-modification program hash comparison and measurable change in controller Input/Output (I/O) behavior. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0783#AN1915","platforms":["Embedded"],"tuning":[{"field":"ChangeControlWindow","description":"Scheduled maintenance periods during which program modifications are authorized."},{"field":"EngineeringWorkstationList","description":"IP allowlist of workstations authorized to modify existing controller program blocks."}],"log_sources":[{"component_id":"DC0111","component":"Software","name":"assetinventory:ProgramHash","channel":"program hash differs from last authorized baseline without corresponding change ticket reference","platforms":["Embedded"],"analytic_id":"AN1915","source_url":"https://attack.mitre.org/detectionstrategies/DET0783#AN1915","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0111/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"write to existing program block address from source not in engineering workstation list outside change control window","platforms":["Embedded"],"analytic_id":"AN1915","source_url":"https://attack.mitre.org/detectionstrategies/DET0783#AN1915","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"},{"component_id":"DC0108","component":"Device Alarm","name":"device:VendorLog","channel":"measurable change in scan cycle timing or Input/Output (I/O) update pattern following a flagged program write","platforms":["Embedded"],"analytic_id":"AN1915","source_url":"https://attack.mitre.org/detectionstrategies/DET0783#AN1915","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0108/"}]}]}],"telemetry_references":[{"id":"DC0108","name":"Device Alarm","tag":"Device Alarm","page":"telemetry/DC0108/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0111","name":"Software","tag":"Software","page":"telemetry/DC0111/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) infects PLCs with different code depending on the characteristics of the target system. An infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior. (Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--cb38425c-646d-4bc8-bdea-e6cc630c3034","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S1006","name":"PLC-Blaster","url":"https://attack.mitre.org/software/S1006","kind":"malware","description":"[PLC-Blaster](https://attack.mitre.org/software/S1006) copies itself to various Program Organization Units (POU) on the target device.  The POUs include the Data Block, Function, and Function Block. (Citation: Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016)","relationship_id":"relationship--9515f24c-1c33-4197-b9c9-b9992bc696ca","references":[{"source_name":"Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016","description":"Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke 2016, March 31 Plc-blaster: A worm living solely in the plc. Retrieved. 2017/09/19 ","url":"https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"}]}],"actors":[{"id":"G1027","name":"CyberAv3ngers","url":"https://attack.mitre.org/groups/G1027","kind":"intrusion-set","description":"During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) used manufacturers’ commercial PLC programming software to modify their victim’s running PLC program logic. These include Rockwell Automation’s [Studio Logix 5000 Designer](https://attack.mitre.org/software/S9054), Schneider Electric’s [EcoStruxure Control Expert](https://attack.mitre.org/software/S9056), and Siemens’ [Totally Integrated Automation (TIA) Portal](https://attack.mitre.org/software/S9055).(Citation: CISA-AA26-097A)","relationship_id":"relationship--efe09c77-8ba8-4735-b1c9-5c9c01a67320","references":[{"source_name":"CISA-AA26-097A","description":"Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"}]}],"mitigations":[{"id":"M0800","name":"Authorization Enforcement","url":"https://attack.mitre.org/mitigations/M0800","kind":"course-of-action","description":"All field controllers should restrict the modification of programs to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.","relationship_id":"relationship--d2a434c7-4428-435e-ae6b-e54012f29606","references":[]},{"id":"M0804","name":"Human User Authentication","url":"https://attack.mitre.org/mitigations/M0804","kind":"course-of-action","description":"All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.","relationship_id":"relationship--fad25140-73de-40d5-a010-3464188db973","references":[]},{"id":"M0945","name":"Code Signing","url":"https://attack.mitre.org/mitigations/M0945","kind":"course-of-action","description":"Utilize code signatures to verify the integrity and authenticity of programs installed on safety or control assets.\n","relationship_id":"relationship--a91002fe-21b2-4417-9c23-af712a7a035c","references":[]},{"id":"M0947","name":"Audit","url":"https://attack.mitre.org/mitigations/M0947","kind":"course-of-action","description":"Provide the ability to verify the integrity of control logic or programs loaded on a controller. While techniques like CRCs and checksums are commonly used, they are not cryptographically strong and can be vulnerable to collisions. Preferably cryptographic hash functions (e.g., SHA-2, SHA-3) should be used. (Citation: IEC February 2019)\n","relationship_id":"relationship--34ac1b1b-1103-4fc9-a62e-f1dd1451b28b","references":[{"source_name":"IEC February 2019","description":"IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ","url":"https://webstore.iec.ch/publication/34421"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0889":"/ttp-simulation/techniques/ics/T0889/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0889","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0108","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","alarm_code":"LAB_COMM_LOSS","severity":"warning","active":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0111","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-engineering-1","software":"Lab HMI runtime","version":"1.0-lab","expected_version":"1.0-lab","sha256":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"}}]}}