1200KM / detection
T0835 Manipulate I/O Image — Detection Rules
Detection workspace for T0835 Manipulate I/O Image: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0773 Detection of Manipulate I/O Image
AN1905 Analytic 1905
Real-time monitoring identifies an Industrial Control System (ICS) protocol write to output register addresses on a field device from a source not in the approved write-source list, correlated with a discrepancy between the value reported by the Input/Output (I/O) image and an independent measurement of the actual physical output state. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures. The independent measurement is process-state telemetry, not network-flow evidence; implementation requires a separately trusted sensor/historian/measurement path with time alignment and an engineering-defined tolerance.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
No reviewed association in this snapshot.
Existing anomaly research
Complete technique engineering workbook
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.