T0838 Modify Alarm Settings — Detection Rules

Source-backed rule directory

No reviewed association in this snapshot.

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0777 Detection of Modify Alarm Settings

AN1909 Analytic 1909

Real-time monitoring identifies Simple Network Management Protocol (SNMP) SET commands to alarm threshold Object Identifiers (OIDs) on Industrial Control System (ICS) network devices or process monitoring systems from a source not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2117 Analytic 2117

Real-time monitoring identifies a write to alarm threshold configuration files on a Linux-based alarm server by a User Identifier (UID) that is not the alarm management service. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2211 Analytic 2211

Real-time monitoring identifies an Industrial Control System (ICS) protocol write specifically targeting alarm threshold/deadband configuration registers from a source not in the approved engineering list, where the new value widens the alarm deadband or shifts the trip point beyond the safe operating envelope, without operator acknowledgment. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.

AN2276 Analytic 2276

Real-time monitoring identifies a write to alarm threshold configuration on an Human-Machine Interface (HMI)/alarm server from a process other than the recognized alarm management application, without a corresponding operator session. OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.