T0845 Program Upload — Attack Simulation

DC0038 collection page — Select the application event family required by the detection and document its native schema before normalization.

Providers and collection configuration

• Application audit logs: First-party service events and request/result fields; schema is application-specific.
• OpenTelemetry-compatible log pipelines: Transport and normalization of emitted records; do not create missing audit instrumentation.

• Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
• Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
• Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.

Required normalized fields: service, action, actor, record_count, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0038",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "lab-portal",
    "action": "export_requested",
    "actor": "lab-reader",
    "record_count": 3,
    "result": "authorized"
  }
}

Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.

DC0085 collection page — Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: flow_id, protocol, method, path, payload_excerpt.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0085",
  "collector": "illustrative-lab-collector",
  "observation": {
    "flow_id": "lab-flow-1",
    "protocol": "http",
    "method": "GET",
    "path": "/lab-check",
    "payload_excerpt": "LAB_TELEMETRY_CHECK"
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S1009 Triton — malware.

  Triton calls the SafeAppendProgramMod to transfer its payloads to the Tricon. Part of this call includes preforming a program upload. [MDudek-ICS]

  Exact relationship: relationship--a946c9b1-5b89-44c9-b617-3412ffda34b9
• S1045 INCONTROLLER — malware.

  INCONTROLLER can use the CODESYS protocol to upload programs from Schneider PLCs.[Wylie-22][Brubaker-Incontroller]

  INCONTROLLER can obtain existing program logic from Omron PLCs by using either the program upload or backup functions available through the HTTP server.[Wylie-22]

  Exact relationship: relationship--b346eec8-de90-407c-b665-387086bb4553

• M0800 Authorization Enforcement

  All field controllers should restrict program uploads to only certain users (e.g., engineers, field technician), preferably through implementing a role-based access mechanism.
  

• M0801 Access Management

  Authenticate all access to field controllers before authorizing access to, or modification of, a device's state, logic, or programs. Centralized authentication techniques can help manage the large number of field controller accounts needed across the ICS.
  

• M0802 Communication Authenticity

  Protocols used for device management should authenticate all network messages to prevent unauthorized system changes.
  

• M0804 Human User Authentication

  All field controllers should require users to authenticate for all remote or local management sessions. The authentication mechanisms should also support Account Use Policies, Password Policies, and User Account Management.

• M0807 Network Allowlists

  Use host-based allowlists to prevent devices from accepting connections from unauthorized systems. For example, allowlists can be used to ensure devices can only connect with master stations or known management/engineering workstations. [Department of Homeland Security September 2016]
  

• M0813 Software Process and Device Authentication

  Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.
  

• M0930 Network Segmentation

  Segment operational network and systems to restrict access to critical system functions to predetermined management systems. [Department of Homeland Security September 2016]
  

• M0937 Filter Network Traffic

  Filter for protocols and payloads associated with program upload activity to prevent unauthorized access to device configurations.