T0843.003 Program Append
sub-techniqueICSAdversaries may execute a program append to a PLC to update parts of an existing program. It may or may not require stopping the PLC which may allow it to continue running during transfer and reconfiguration without interruption to process control. Adversaries may leverage this approach to minimize downtime and evade detection. The ability to perform a program append to the PLC typically relies on access to a workstation with the vendor-specific PLC programming software installed.
01
platforms
Platforms this applies to.
Embedded
02
sub-technique of
The broader entity this sits under.
03
mitigations
ATT&CK mitigations that reduce this.
04
detected by (2)
Data components that detect this.
05
targets assets (4)
ICS/OT assets this targets.
06
campaigns (1)
Campaigns that use this.
07
source
Where this definition is published.