Change Program State

Change Program State
Technique
ID	T875
Tactic	Execution, Impair Process Control
Data Sources	Alarm history, Sequential event recorder, Network protocol analysis, Packet capture
Asset	Field Controller/RTU/PLC/IED

Description

Adversaries may attempt to change the state of the current program on a control device. Program state changes may be used to allow for another program to take over control or be loaded onto the device.

Procedure Examples

After PLC-Blaster is transferred to a PLC, the PLC begins execution of PLC-Blaster.1
Stuxnet halts the original PLC code and the malicious PLC code begins sending frames of data based on the recorded values during the DP_RECV monitor phase.2
Triton has the ability to halt or run a program through the TriStation protocol. TsHi.py contains instances of halt and run functions being executed.3

References

^ MDudek-ICS. (n.d.). TRISIS-TRITON-HATMAN. Retrieved November 3, 2019.

v · d · e Adversary Techniques

Initial Access	Data Historian Compromise Drive-by Compromise Engineering Workstation Compromise Exploit Public-Facing Application External Remote Services Initial Access Internet Accessible Device Replication Through Removable Media Spearphishing Attachment Supply Chain Compromise Wireless Compromise

Execution	Change Program State Command-Line Interface Execution Execution through API Graphical User Interface Man in the Middle Program Organization Units Project File Infection Scripting User Execution

Persistence	Hooking Module Firmware Persistence Program Download Project File Infection System Firmware Valid Accounts

Evasion	Evasion Exploitation for Evasion Indicator Removal on Host Masquerading Rogue Master Device Rootkit Spoof Reporting Message Utilize/Change Operating Mode

Discovery	Control Device Identification Discovery I/O Module Discovery Network Connection Enumeration Network Service Scanning Network Sniffing Remote System Discovery Serial Connection Enumeration

Lateral Movement	Default Credentials Exploitation of Remote Services External Remote Services Lateral Movement Program Organization Units Remote File Copy Valid Accounts

Collection	Automated Collection Collection Data from Information Repositories Detect Operating Mode Detect Program State I/O Image Location Identification Monitor Process State Point & Tag Identification Program Upload Role Identification Screen Capture

Inhibit Response Function	Activate Firmware Update Mode Alarm Suppression Block Command Message Block Reporting Message Block Serial COM Data Destruction Denial of Service Device Restart/Shutdown Inhibit Response Function Manipulate I/O Image Modify Alarm Settings Modify Control Logic Program Download Rootkit System Firmware Utilize/Change Operating Mode

Impair Process Control	Brute Force I/O Change Program State Impair Process Control Masquerading Modify Control Logic Modify Parameter Module Firmware Program Download Rogue Master Device Service Stop Spoof Reporting Message Unauthorized Command Message

Impact	Damage to Property Denial of Control Denial of View Impact Loss of Availability Loss of Control Loss of Productivity and Revenue Loss of Safety Loss of View Manipulation of Control Manipulation of View Theft of Operational Information

Change Program State

Description

Procedure Examples

References

Navigation menu

Personal tools

Namespaces

Variants

Views

More

Search

ATT&CK™

Questions?

Tools