DET0776 Detection of Modify Parameter

Technique Detected: T0836 (Modify Parameter)

Analytics

ICS

AN1908

Monitor asset management systems for device configuration changes which can be used to understand expected parameter settings. Monitor device application logs parameter changes, although not all devices will produce such logs. Monitor for device alarms produced when parameters are changed, although not all devices will produce such alarms. Monitor ICS management protocols for parameter changes, including for unexpected values, changes far exceeding standard values, or for parameters being changed in an unexpected way (e.g., via a new function, at an unusual time).

Log Sources

Mutable Elements