MITRE ATT&CK for ICS T0843 Program Download: Detecting and Stopping Unauthorised PLC Logic Changes

Program Download (T0843) is an adversary writing their own logic into a controller, using the same engineering function that commissioning and maintenance teams rely on every day. Once malicious logic is running on a PLC or safety controller, the adversary no longer needs a foothold on the network to affect the process: the controller does the work. MITRE ATT&CK for ICS v20 lists T0843 under Lateral Movement for the Embedded platform and now splits it into three sub-techniques: Download All, Online Edit and Program Append. This guide is for control engineers, OT security engineers and OT SOC analysts who need to tell an approved download from an unauthorised one, stop the second, and respond without making the process less safe. For the wider matrix see the MITRE ATT&CK for ICS Guide, and for the tactic as a whole the ATT&CK for ICS Lateral Movement Tactic Guide.

Key takeaways

• Download is the delivery step for logic attacks. ATT&CK states that Modify Controller Tasking (T0821) and Modify Program (T0889) are the changes that program download transfers to a controller.
• The quiet variants matter most. Online edit and program append let a controller keep running during the transfer, so ATT&CK notes an adversary may prefer them to avoid disturbing the process and to evade detection.
• Real intrusions used vendor software. In the 2026 Iranian Water Campaign, ATT&CK records CyberAv3ngers pushing new configurations with the manufacturers' own PLC programming software; Triton, INCONTROLLER and PLC-Blaster used vendor protocols or APIs, and Stuxnet downloaded code and data blocks to the PLC.
• Detection joins three signals. The v20 analytic correlates a download session from an unapproved source, a preceding mode change to PROGRAM or STOP, and a program hash that no longer matches the approved baseline.
• Physical and procedural controls still work. Run mode key switches, programming protection, a narrow engineering path and verified offline backups block or undo most unauthorised downloads.

What T0843 covers and how the sub-techniques differ

ATT&CK describes program download as transferring a user program to a controller. The granularity of the transfer is set by the vendor management protocol and controller API (ATT&CK names S7CommPlus and TriStation as examples), so "program download" is a high-level term for a suite of vendor-specific calls that configure the controller's user program memory. An adversary may first need Detect Operating Mode (T0868) or Change Operating Mode (T0858) so the controller will accept the transfer.

For all three, ATT&CK notes the ability typically relies on access to a workstation with the vendor-specific PLC programming software installed. That makes the engineering workstation and the path from it to the controller the main things to defend. See the Engineering Workstation Security Guide.

Two neighbouring techniques help scope the page. Program Upload (T0845) is the reverse direction, a read from the controller, and often comes first so the adversary can study the logic; see T0845 Program Upload. Modify Program covers what the downloaded logic does once it is there; see T0889 Modify Program.

Procedure examples in ATT&CK

The joint advisory on the 2026 activity (AA26-097A, published 7 April 2026 and updated 22 July 2026 by FBI, CISA, NSA, EPA, DOE, US Cyber Command's Cyber National Mission Force and the Department of the Treasury) adds detail. It describes the actors downloading malicious project files to PLCs with configuration software, in one case adding logic that overrode instruction sets maintaining safe operating parameters. Affected products named include Rockwell Automation CompactLogix and Micro850, Schneider Electric Modicon M340 (BMX P34) and Siemens S7-1200, reached over internet-exposed ports including 44818, 2222, 102 and 502. See the Water and Wastewater Cybersecurity Guide.

Detection: the ATT&CK v20 analytic

MITRE's detection strategy for T0843 (DET0752, Detection of Program Download) has one embedded-platform analytic. Each sub-technique has its own strategy as well: DET0913 for Download All, DET0915 for Online Edit and DET0914 for Program Append. ATT&CK applies an OT operational fidelity gate: alert only when the action is not attributable to an authorised operator or engineering source for that target and function, and falls outside an approved change window or lacks change control context; suppress activity that fully matches approved maintenance, commissioning or tested procedures.

Online edit and program append may not trigger a stop mode event, so the network and hash signals carry more weight for them. AA26-097A gives the same direction: monitor network traffic for functions that change operating mode or modify programs, compare running project files against known-good logic using vendor integrity tools, and check Add-On Instructions for unauthorised changes. Internet exposure itself is covered in T0883 Internet Accessible Device. See the OT Network Security Monitoring Guide and ICS T0858 Change Operating Mode.

Prevention: ATT&CK mitigations in practice

AA26-097A adds vendor-specific steps: set Rockwell controllers' physical mode switch to RUN and use program or remote mode only for updates, and enable programming protection such as key-switch protection in TIA Portal on Siemens devices that support it. It notes that validating the project file first matters, because the mode change locks in the current file. See the PLC Security Guide.

Where identity fits

Every download is made by someone, through some account, on some host. Shared engineering logins, controller passwords held by integrators after a project ends, and vendor remote access accounts that never expire all widen who can download logic. Use named engineering accounts, time-bound integrator and vendor access tied to a change ticket, and rotation of controller and project passwords when people leave. Treat the service accounts of jump hosts and automated backup tools as privileged, because they can reach every controller. See the OT and ICS Identity and Access Guide and the OT Third-Party and Integrator Access Guide.

How to implement

1. Baseline: record the approved program for every controller, with a SHA-256 hash, block list and version, stored offline. See the OT Backup, Recovery and Golden Image Guide.
2. Name the legitimate sources: list the engineering workstations and jump hosts allowed to program each controller, and the change windows.
3. Close the internet path first: remove any inbound exposure of controller management ports, as AA26-097A puts first in its immediate steps.
4. Restrict at the conduit: allow management protocols to controllers only from the named sources; log denies for a period before enforcing so missed legitimate flows show up.
5. Deploy DET0752-style alerts in alert-only mode through at least one maintenance cycle, tune with control engineers, then route to the OT SOC queue.
6. Enable controller protections: passwords, programming protection and run mode key positions, tested first on a spare controller, with previous settings recorded for rollback.
7. Link changes to tickets: require a change reference in the engineering workflow so the analytic can separate approved from unapproved downloads.

Decision guidance

• Controllers with access control and signing: enable them after testing; the cost is credential and key management.
• Legacy controllers without authentication: rely on the physical key switch, a single permitted engineering path, network allowlists and hash comparison, and plan replacement.
• Small sites with remote support: the highest-value steps are no internet exposure, one hardened jump host with MFA, run mode key positions and offline backups.
• Large or safety-critical sites: add protocol-aware monitoring, engineering log collection, automated hash comparison and a separate path to safety controllers. See the Safety Instrumented Systems Security Guide.

Responding to an unauthorised download

Unlike an upload, a download may already be changing the process. Process safety comes first and operations lead every action on the controller.

1. Confirm with operations and engineering whether the change was planned. If not, have operations assess the process state and decide whether manual or local control is needed.
2. Preserve evidence before changing anything: the network capture, engineering workstation logs, controller diagnostic buffer and an upload of the running program for comparison.
3. Contain the path: block the source host at the conduit, disable the account used and remove remote access until the scope is known.
4. Restore known-good logic from a backup verified free of malicious logic, as AA26-097A advises, in a window operations approves, and confirm the hash afterwards.
5. Look wider: check other controllers reachable from the same host, HMIs and modems for the same activity, and report to CISA or your national authority where required.

See the OT Incident Response Guide.

Detection and measurement

• Baseline coverage: percentage of controllers with a current, hashed, offline program baseline.
• Reachability: number of hosts able to reach controller management ports, against the approved list (target: equal).
• Protection coverage: percentage of controllers in run mode with programming protection or passwords enabled where supported.
• Unexplained downloads: count of download, online edit or append sessions without a change reference.
• Hash drift: controllers whose running program differs from baseline, and time to explain each one.

Framework mapping

Common failure patterns

• Controllers reachable from the internet: the 2026 activity in AA26-097A targeted internet-exposed PLCs on their native ports.
• Key switches left in program or remote mode: the controller accepts downloads from anyone who can reach it.
• Only full downloads are alerted: online edits and appends that keep the process running pass unseen.
• Backups never verified: restoring a backup taken after the compromise reinstalls the adversary's logic.
• Checksums treated as integrity: ATT&CK notes CRCs and checksums are not cryptographically secure.
• Integrator and vendor access never removed: old credentials keep a download path open.

Practitioner checklist

• Remove all internet exposure of controller management ports.
• Keep a hashed, offline baseline of every controller program and check it after each change.
• Restrict management protocols to named engineering hosts at every conduit.
• Alert on download, online edit and append sessions from unapproved sources or without a change reference.
• Keep key switches in run mode outside approved programming windows.
• Enable controller passwords, programming protection and signing where supported, after testing.
• Use named, time-bound engineering and vendor accounts.
• Rehearse restoring verified logic with operations.

Standards and references

• MITRE ATT&CK for ICS: Program Download (T0843)
• MITRE ATT&CK: Detection of Program Download (DET0752)
• MITRE ATT&CK: CyberAv3ngers (G1027)
• MITRE ATT&CK: Triton (S1009)
• FBI, CISA and partners: AA26-097A, Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure
• Mandiant: Attackers Deploy New ICS Attack Framework TRITON
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security

Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · PLC Security Guide · T0889 Modify Program · Engineering Workstation Security Guide