Modify Program
Description
Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network. Modification to controller programs can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append. Program modification encompasses the addition and modification of instructions and logic contained in Program Organization Units (POU) (Citation: IEC February 2013) and similar programming elements found on controllers. This can include, for example, adding new functions to a controller, modifying the logic in existing functions and making new calls from one function to another. Some programs may allow an adversary to interact directly with the native API of the controller to take advantage of obscure features or vulnerabilities.
Mapped SPARTA techniques
3 techniques
T0889 'Modify Program' is in MITRE ICS persistence tactic and addresses adversary modification or addition of programs on a controller to affect its behavior — direct concept-match for SPARTA PER-0001 'Memory Compromise' (modify FSW program memory to maintain persistent access). Tactic and activity align directly.
Backdoors in flight software are implemented by modifying or adding programs on the spacecraft controller; T0889 'Modify Program' is the persistence-tactic-aligned ATT&CK ICS technique covering exactly this activity at parent level. Tactic and activity align.
Software backdoors are implemented by modifying spacecraft programs to include attacker-controlled code paths; T0889 'Modify Program' addresses exactly this persistence-tactic activity. Tactic and activity align directly.
Cite as SafeMode Space, mitre-attack-ics T0889.