{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T1693","id":"T1693","name":"Modify Firmware","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1693","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"40d74053f4f0ef907a355aa4ecc68846190a7ef33488a50f30b30b0709817fd8","description":"Firmware is low-level software embedded in hardware that enables systems and devices to function properly and is commonly found in ICS environments. Adversaries may modify firmware on a system or device by installing malicious or vulnerable versions that enable them to achieve objectives such as [Persistence](https://attack.mitre.org/tactics/TA0110), [Impair Process Control](https://attack.mitre.org/tactics/TA0106), and [Inhibit Response Function](https://attack.mitre.org/tactics/TA0107). \n\nAdversaries may modify system and device firmware by using the built-in firmware update functionality which may support local or remote installation. The malicious or vulnerable firmware may be delivered via [Replication Through Removable Media](https://attack.mitre.org/techniques/T0847), [Supply Chain Compromise](https://attack.mitre.org/techniques/T0862), or [Remote Services](https://attack.mitre.org/techniques/T0886). Once installed, the malicious or vulnerable firmware could be used to provide [Rootkit](https://attack.mitre.org/techniques/T0851) and [Hooking](https://attack.mitre.org/techniques/T0874) functionality, [Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T0890), or [Denial of Service](https://attack.mitre.org/techniques/T0814).(Citation: Basnight, Zachry, et al.)\n","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1693","external_id":"T1693"},{"source_name":"Basnight, Zachry, et al.","description":"Basnight, Zachry, et al. 2013 Retrieved. 2017/10/17 ","url":"http://www.sciencedirect.com/science/article/pii/S1874548213000231"}],"platforms":["Embedded"],"environments":["ics-ot"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"ics/T1693.001","id":"T1693.001","name":"System Firmware","page":"techniques/ics/T1693.001/"},{"key":"ics/T1693.002","id":"T1693.002","name":"Module Firmware","page":"techniques/ics/T1693.002/"}],"telemetry":[{"id":"DC0108","name":"Device Alarm","page":"telemetry/DC0108/","kind":"attack_component","category":"Industrial operations and physical process","description":"Device-generated alarms about equipment or controller state.","collection_focus":"Subscribe to supported device alarm/audit channels; retain code, severity, source asset and acknowledgement/clear times.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["asset_id","alarm_code","severity","active"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0108","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","alarm_code":"LAB_COMM_LOSS","severity":"warning","active":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"attack_component","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."},{"id":"DC0004","name":"Firmware Modification","page":"telemetry/DC0004/","kind":"attack_component","category":"Host state and inventory","description":"Changes to firmware state or a firmware update observation on a device.","collection_focus":"Collect approved OEM firmware inventory/update audit and compare version or measured hashes against a known baseline. Use read-only vendor-supported interfaces.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["asset_id","firmware_before","firmware_after","change_ticket"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0004","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-device-1","firmware_before":"1.0-lab","firmware_after":"1.1-lab","change_ticket":"LAB-42"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"ics/T1693","id":"T1693","name":"Modify Firmware","domain":"ics","platforms":["Embedded"],"environments":["ics-ot"],"source_url":"https://attack.mitre.org/techniques/T1693","technique_page":"techniques/ics/T1693/","page":"detections/ics/T1693/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0904","name":"Detection of Firmware Modification","url":"https://attack.mitre.org/detectionstrategies/DET0904","stix_id":"x-mitre-detection-strategy--73773bb8-c63b-4d48-9b48-33440f12a514","relationship_id":"relationship--3066ddc9-b4e8-41b6-a28f-9de5030cb714","description":"","analytics":[{"id":"AN2047","name":"Analytic 2047","guidance":"Real-time monitoring identifies the full firmware modification chain: a device entering firmware-update mode, receiving a large data transfer on a firmware-capable protocol port from a source not in the approved engineering workstation list, rebooting, and reporting a post-reboot firmware hash that does not match the authorized inventory. This technique-level analytic synthesizes System Firmware (T1693.001) and Module Firmware (T1693.002). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.","url":"https://attack.mitre.org/detectionstrategies/DET0904#AN2047","platforms":["Embedded"],"tuning":[{"field":"AuthorizedFirmwareInventory","description":"Cryptographic hash inventory of authorized firmware versions, covering both main processor and module-level firmware."},{"field":"ChangeControlWindow","description":"Scheduled maintenance periods during which firmware updates are authorized."},{"field":"EngineeringWorkstationList","description":"IP allowlist of workstations authorized to perform firmware updates."},{"field":"FirmwareUpdateWindow","description":"Time window within which a device reboot following a large transfer session is considered part of the same firmware update event."}],"log_sources":[{"component_id":"DC0004","component":"Firmware Modification","name":"assetinventory:FirmwareHash","channel":"post-reboot firmware hash (main processor or specific module) not in authorized firmware inventory","platforms":["Embedded"],"analytic_id":"AN2047","source_url":"https://attack.mitre.org/detectionstrategies/DET0904#AN2047","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0004/"},{"component_id":"DC0108","component":"Device Alarm","name":"operationaldb:AlarmEvent","channel":"device reboot within firmware update window of the flagged transfer session","platforms":["Embedded"],"analytic_id":"AN2047","source_url":"https://attack.mitre.org/detectionstrategies/DET0904#AN2047","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0108/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"NSM:Content","channel":"large session on firmware-capable port from source not in engineering workstation list outside change control window","platforms":["Embedded"],"analytic_id":"AN2047","source_url":"https://attack.mitre.org/detectionstrategies/DET0904#AN2047","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0108","name":"Device Alarm","tag":"Device Alarm","page":"telemetry/DC0108/","kind":"attack_component"},{"id":"DC0004","name":"Firmware Modification","tag":"Firmware Modification","page":"telemetry/DC0004/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M0801","name":"Access Management","url":"https://attack.mitre.org/mitigations/M0801","kind":"course-of-action","description":"All devices or systems changes, including all administrative functions, should require authentication. Consider using access management technologies to enforce authorization on all management interface access attempts, especially when the device does not inherently provide strong authentication and authorization functions.","relationship_id":"relationship--de6a1c7c-8d90-4f5c-8618-7c7ea9a2da89","references":[]},{"id":"M0802","name":"Communication Authenticity","url":"https://attack.mitre.org/mitigations/M0802","kind":"course-of-action","description":"Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.","relationship_id":"relationship--01c8cc53-dfd0-4afc-8df6-e57494bd9e24","references":[]},{"id":"M0804","name":"Human User Authentication","url":"https://attack.mitre.org/mitigations/M0804","kind":"course-of-action","description":"Devices that allow remote management of firmware should require authentication before allowing any changes. The authentication mechanisms should also support [Account Use Policies](https://attack.mitre.org/mitigations/M0936), [Password Policies](https://attack.mitre.org/mitigations/M0927), and [User Account Management](https://attack.mitre.org/mitigations/M0918).","relationship_id":"relationship--962128bd-13b9-48a6-a4c8-3f07104a962f","references":[]},{"id":"M0807","name":"Network Allowlists","url":"https://attack.mitre.org/mitigations/M0807","kind":"course-of-action","description":"Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.(Citation: Department of Homeland Security September 2016)","relationship_id":"relationship--41abc220-4ec6-41cc-bb36-37c43341fc41","references":[{"source_name":"Department of Homeland Security September 2016","description":"Department of Homeland Security 2016, September Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"}]},{"id":"M0808","name":"Encrypt Network Traffic","url":"https://attack.mitre.org/mitigations/M0808","kind":"course-of-action","description":"The encryption of firmware should be considered to prevent adversaries from identifying possible vulnerabilities within the firmware.","relationship_id":"relationship--5b060600-e8b8-4dd8-8ed7-aadbccb8e2a8","references":[]},{"id":"M0813","name":"Software Process and Device Authentication","url":"https://attack.mitre.org/mitigations/M0813","kind":"course-of-action","description":"Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.","relationship_id":"relationship--a3971be9-7bef-4663-b6c3-3cffc418f76b","references":[]},{"id":"M0930","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M0930","kind":"course-of-action","description":"Segment operational network and systems to restrict access to critical system functions to predetermined management systems.(Citation: Department of Homeland Security September 2016)","relationship_id":"relationship--21c7b1bb-ba40-4843-b462-079b1b85c01b","references":[{"source_name":"Department of Homeland Security September 2016","description":"Department of Homeland Security 2016, September Retrieved. 2020/09/25 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"}]},{"id":"M0937","name":"Filter Network Traffic","url":"https://attack.mitre.org/mitigations/M0937","kind":"course-of-action","description":"Filter for protocols and payloads associated with firmware activation or updating activity.","relationship_id":"relationship--fc77a4bc-1383-492a-a04b-9062345ced53","references":[]},{"id":"M0941","name":"Encrypt Sensitive Information","url":"https://attack.mitre.org/mitigations/M0941","kind":"course-of-action","description":"The encryption of firmware should be considered to prevent adversaries from identifying possible vulnerabilities within the firmware.","relationship_id":"relationship--d462143c-69d1-44c9-b657-b64deb12eab8","references":[]},{"id":"M0945","name":"Code Signing","url":"https://attack.mitre.org/mitigations/M0945","kind":"course-of-action","description":"Devices should verify that firmware has been properly signed by the vendor before allowing installation.","relationship_id":"relationship--2d621264-4a6d-4bc7-abaf-89a89c2ef813","references":[]},{"id":"M0946","name":"Boot Integrity","url":"https://attack.mitre.org/mitigations/M0946","kind":"course-of-action","description":"Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification. Use Trusted Platform Module technology.(Citation: N/A) Move system's root of trust to hardware to prevent tampering with the SPI flash memory.(Citation: ESET Research Whitepapers September 2018) Technologies such as Intel Boot Guard can assist with this.(Citation: Intel)","relationship_id":"relationship--cb993689-bb59-4c96-b9fd-42cfcb92d76f","references":[{"source_name":"ESET Research Whitepapers September 2018","description":"ESET Research Whitepapers 2018, September LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group Retrieved. 2020/09/25 ","url":"https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf"},{"source_name":"Intel","description":"Intel ESET Research Whitepapers 2018, September LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group Retrieved. 2020/09/25  Intel Hardware-based Security Technologies for Intelligent Retail Devices Retrieved. 2020/09/25 ","url":"https://www.intel.com/content/dam/www/public/us/en/documents/white-papers/security-technologies-4th-gen-core-retail-paper.pdf"},{"source_name":"N/A","description":"N/A   Trusted Platform Module (TPM) Summary Retrieved. 2020/09/25 ","url":"https://www.trustedcomputinggroup.org/wp-content/uploads/Trusted-Platform-Module-Summary_04292008.pdf"}]},{"id":"M0947","name":"Audit","url":"https://attack.mitre.org/mitigations/M0947","kind":"course-of-action","description":"Perform integrity checks of firmware before uploading it on a device. Utilize cryptographic hashes to verify the firmware has not been tampered with by comparing it to a trusted hash of the firmware. This could be from trusted data sources (e.g., vendor site) or through a third-party verification service.","relationship_id":"relationship--6bbb12c3-171d-45a5-a01b-a74b0c0704f0","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0847":"/ttp-simulation/techniques/ics/T0847/","T0862":"/ttp-simulation/techniques/ics/T0862/","T0886":"/ttp-simulation/techniques/ics/T0886/","T0851":"/ttp-simulation/techniques/ics/T0851/","T0874":"/ttp-simulation/techniques/ics/T0874/","T0890":"/ttp-simulation/techniques/ics/T0890/","T0814":"/ttp-simulation/techniques/ics/T0814/","T1693":"/ttp-simulation/techniques/ics/T1693/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T1693","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0108","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-controller-1","alarm_code":"LAB_COMM_LOSS","severity":"warning","active":true}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0004","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-device-1","firmware_before":"1.0-lab","firmware_after":"1.1-lab","change_ticket":"LAB-42"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}}]}}