T0843 Program Download — Attack Simulation

DC0038 collection page — Select the application event family required by the detection and document its native schema before normalization.

Providers and collection configuration

• Application audit logs: First-party service events and request/result fields; schema is application-specific.
• OpenTelemetry-compatible log pipelines: Transport and normalization of emitted records; do not create missing audit instrumentation.

• Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
• Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
• Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.

Required normalized fields: service, action, actor, record_count, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0038",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "lab-portal",
    "action": "export_requested",
    "actor": "lab-reader",
    "record_count": 3,
    "result": "authorized"
  }
}

Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.

DC0110 collection page — Prefer approved inventory exports and passive discovery; retain model, firmware, owner and observation source. Do not scan a production control network as a default collection step.

Providers and collection configuration

• OPC UA audit-capable servers: Auditable actions where supported and enabled; inspect server conformance and vendor documentation.
• Controller, HMI and historian exports: Vendor-specific process values, quality flags, alarms and operational context.
• Independent lab sensors / safety records: Physical-effect corroboration, not a universal cybersecurity log format.

• Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.
• Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.
• Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs.

Required normalized fields: asset_id, role, firmware, source.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0110",
  "collector": "illustrative-lab-collector",
  "observation": {
    "asset_id": "lab-controller-1",
    "role": "PLC_fixture",
    "firmware": "lab-1.0",
    "source": "approved_inventory"
  }
}

Visibility limits: There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.

DC0108 collection page — Subscribe to supported device alarm/audit channels; retain code, severity, source asset and acknowledgement/clear times.

Providers and collection configuration

• OPC UA audit-capable servers: Auditable actions where supported and enabled; inspect server conformance and vendor documentation.
• Controller, HMI and historian exports: Vendor-specific process values, quality flags, alarms and operational context.
• Independent lab sensors / safety records: Physical-effect corroboration, not a universal cybersecurity log format.

• Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.
• Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.
• Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs.

Required normalized fields: asset_id, alarm_code, severity, active.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0108",
  "collector": "illustrative-lab-collector",
  "observation": {
    "asset_id": "lab-controller-1",
    "alarm_code": "LAB_COMM_LOSS",
    "severity": "warning",
    "active": true
  }
}

Visibility limits: There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.

DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: flow_id, protocol, method, path, payload_excerpt.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0085",
  "collector": "illustrative-lab-collector",
  "observation": {
    "flow_id": "lab-flow-1",
    "protocol": "http",
    "method": "GET",
    "path": "/lab-check",
    "payload_excerpt": "LAB_TELEMETRY_CHECK"
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S0603 Stuxnet — malware.

  Stuxnet's infection sequence consists of code blocks and data blocks that will be downloaded to the PLC to alter its behavior. [Nicolas Falliere, Liam O Murchu, Eric Chien February 2011]

  Exact relationship: relationship--7c893581-c847-495a-aa93-9d98c516e1ae
• S1006 PLC-Blaster — malware.

  PLC-Blaster utilizes the PLC communication and management API to load executable Program Organization Units. [Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016]

  Exact relationship: relationship--31897c41-1d47-4a34-b531-21c3f74651a8
• S1009 Triton — malware.

  Triton leveraged the TriStation protocol to download programs onto Triconex Safety Instrumented System.[Jos Wetzels January 2018]

  Exact relationship: relationship--1f8abf6f-0dd0-4449-b555-733fe7296177
• S1045 INCONTROLLER — malware.

  INCONTROLLER has used the CODESYS protocol to download programs to Schneider PLCs.[Wylie-22][Brubaker-Incontroller] INCONTROLLER has also modified program logic on Omron PLCs using either the program download or backup transfer functions available through the HTTP server.[Wylie-22]

  Exact relationship: relationship--7c1eee62-3307-4e25-8a20-919ccd56ec1c

• M0800 Authorization Enforcement

  All field controllers should restrict the download of programs, including online edits and program appends, to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.
  

• M0801 Access Management

  Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.
  

• M0802 Communication Authenticity

  Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.
  

• M0804 Human User Authentication

  All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.

• M0807 Network Allowlists

  Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations.[Department of Homeland Security September 2016]
  

• M0813 Software Process and Device Authentication

  Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.
  

• M0930 Network Segmentation

  Segment operational network and systems to restrict access to critical system functions to predetermined management systems.[Department of Homeland Security September 2016]
  

• M0937 Filter Network Traffic

  Filter for protocols and payloads associated with program download activity to prevent unauthorized device configurations.
  

• M0945 Code Signing

  Utilize code signatures to verify the integrity and authenticity of programs downloaded to the device.
  

• M0947 Audit

  Provide the ability to verify the integrity of programs downloaded on a controller. While techniques like CRCs and checksums are commonly used, they are not cryptographically secure and can be vulnerable to collisions. Preferably cryptographic hash functions (e.g., SHA-2, SHA-3) should be used.[IEC February 2019]