DET0741 Detection of Modify Controller Tasking

Technique Detected: T0821 (Modify Controller Tasking)

Analytics

ICS

AN1874

Monitor asset application logs for information that indicate task parameters have changed. Monitor device alarms that indicate controller task parameters have changed, although not all devices produce such alarms.

Program Download may be used to enable this technique. Monitor for program downloads which may be noticeable via operational alarms. Asset management systems should be consulted to understand expected program versions. Engineering and asset management software will often maintain a copy of the expected program loaded on a controller and may also record any changes made to controller programs and tasks. Data from these platforms can be used to identify modified controller tasking.

Log Sources

Mutable Elements