DET0768 Detection of Detect Operating Mode

Technique Detected: T0868 (Detect Operating Mode)

Analytics

ICS

AN1900

Monitor ICS automation network protocols for functions related to reading an asset’s operating mode. In some cases, there may be multiple ways to detect a device’s operating mode, one of which is typically used in the operational environment. Monitor for the operating mode being checked in unexpected ways.

Log Sources

Mutable Elements