T0843.002 Online Edit
sub-techniqueICSAdversaries may execute an online edit of a PLC to update parts of an existing program. It does not require stopping the PLC which allows it to continue running during transfer and reconfiguration without interruption to process control. Adversaries may leverage this approach to minimize downtime and evade detection. The ability to perform an online edit to the PLC typically relies on access to a workstation with the vendor-specific PLC programming software installed.
01
platforms
Platforms this applies to.
Embedded
02
sub-technique of
The broader entity this sits under.
03
mitigations
ATT&CK mitigations that reduce this.
04
detected by (2)
Data components that detect this.
05
targets assets (4)
ICS/OT assets this targets.
06
source
Where this definition is published.