ATT&CK for ICS T0892 Change Credential Guide

Change Credential (T0892) turns a device's own access protection against its owner: the adversary sets a new password or key, and operators and responders can no longer manage the device. MITRE ATT&CK for ICS places it in the Inhibit Response Function tactic because the aim is to slow or stop recovery, and ATT&CK notes that some devices then need a factory reset, replacement or a return to the vendor. Recent procedure examples include German building automation lockouts, the December 2025 attacks on Polish energy sites and the 2026 attacks on US water utility PLCs. This guide is for OT security engineers, control engineers and incident responders: how to stop credentials being changed, how to spot it, and how to plan recovery before you need it. For the tactic overview see the ATT&CK for ICS Inhibit Response Function Tactic Guide.

Key takeaways

The attacker needs a credential first. ATT&CK describes an adversary with valid or hardcoded credentials changing them; in the recorded cases those were default or unset credentials on reachable devices.
Recovery is the real cost. Depending on the device, a changed password may block all configuration actions until a factory reset, hardware replacement or vendor return.
It is usually paired with something worse. ATT&CK warns that T0892 is especially damaging alongside Modify Program, Data Destruction or Modify Controller Tasking, because the malicious state cannot be removed through normal configuration.
Three mitigations, all preparatory. ATT&CK lists Password Policies, Data Backup and Redundancy of Service: change defaults, keep gold copies, and hold cold standby hardware.
Detection keys on who changed it and what broke next. ATT&CK's analytics flag credential changes from outside the approved administration list followed by legitimate components failing to connect.

What T0892 covers

ATT&CK for ICS v20 lists T0892 for Embedded, Windows, Linux and Network Devices. The credentials in scope are mostly built-in device features meant to restrict management interfaces: controller passwords, programming keys, web interface logins and network device credentials. The technique description says these passwords sometimes cannot be removed onsite and may require the device to be sent back to the vendor.

Technique	Tactic	Relationship to T0892
T0859 Valid Accounts	Persistence, Lateral Movement	How the adversary usually gets in; ATT&CK notes default credentials for control devices may be publicly available
T0889 Modify Program	Persistence	Altered logic that a locked device then protects from correction
T0809 Data Destruction	Inhibit Response Function	Destroyed configuration that cannot be restored while locked out
T0816 Device Restart/Shutdown	Inhibit Response Function	Often seen in the same destructive activity
T1098 Account Manipulation (Enterprise)	Persistence, Privilege Escalation	The IT counterpart for directory and host accounts; see the MITRE ATT&CK T1098 Account Manipulation Guide

Procedure examples and what they teach

German building automation lockouts (2021): ATT&CK cites a chain of incidents in which adversaries locked operators out of building automation controllers by setting a previously unset BCU key. Dark Reading's report of the Limes Security investigation describes KNX devices in an office building wiped and locked with the attackers' key, a 4-byte programming password; about three-quarters of the devices were affected, vendors could not supply the key, and the building ran on manual switching of central breakers for several weeks until the key was recovered from a device's memory. Access had come through a UDP port exposed to the internet. See the Building Management System Security Guide.
2025 Poland Wiper Attacks (C0063): ATT&CK records that adversaries changed the login password of Moxa NPort serial device servers to impede recovery. CERT Polska's incident report states the devices had web interfaces enabled with default credentials, which the attacker used to restore factory settings, change the password and set an unreachable IP address, and that the changes were intended to delay restoration. See the Industrial Switch and Serial Gateway Hardening Guide.
2026 U.S. Water Utilities Attacks (C0066): ATT&CK records that the adversary accessed internet-facing MicroLogix 1100 and 1400 controllers and changed passwords, causing loss of monitoring and control for the affected utilities. ATT&CK does not attribute this campaign to any group. Dragos and Tenable describe more than 30 Minnesota utilities affected from late July 2026, with some moving to manual operations. Forescout reports that Rockwell issued guidance on restoring access to MicroLogix controllers after an attacker changed the password. See the Water and Wastewater Cybersecurity Guide.
2026 Iranian Water Campaign (C0065), CyberAv3ngers (G1027): ATT&CK records that during this campaign CyberAv3ngers locked out operators by changing PLC passwords and IP addresses. This is a separate campaign from C0066.

All three share one pattern: a reachable management interface, a default or unset credential, and no prepared recovery path.

Prevention

ATT&CK mitigation	What ATT&CK says for T0892	How to apply it
M0927 Password Policies	Change default usernames and passwords immediately after installation and before production deployment	Commissioning checklist item for every controller, gateway, switch and HMI; set unset keys and passwords yourself so an attacker cannot set them first
M0953 Data Backup	Keep hardened backups separate from the corporate network, and manage gold-copy images and configurations for quick recovery	Store device configurations, programs and the current credentials needed to restore them offline
M0811 Redundancy of Service	Retain cold standby or replacement hardware of similar models	Hold spares for controllers and gateways whose lockout needs a vendor return

Unique credentials per device: the Dark Reading report notes the attackers used one key across all components, which made recovery easier once it was found; your own credentials should be unique per device and site so one leak does not open everything. CERT Polska's report likewise points to default credentials reused across facilities.
Credential vault for device secrets: keep controller passwords, programming keys and network device credentials in a vault with named access and break-glass procedures, not in project files or spreadsheets. See the OT and ICS Identity and Access Guide.
Remove exposure: management interfaces should not be reachable from the internet or from IT. Tenable's summary of federal guidance puts removing PLCs from direct internet exposure first, with MFA-protected gateways where remote access is needed. See the OT Remote Access Guide.
Disable unused interfaces: web, FTP and other management services that are not needed should be off; CERT Polska's report describes web interfaces and default service accounts as the routes used.

Detection

ATT&CK v20 detection strategy DET0771 (Detection of Change Credential) has one analytic per platform, each with ATT&CK's operational fidelity gate: alert when the change cannot be attributed to an authorised source and falls outside an approved change window or lacks change-control context.

Platform	Analytic	What to look for
Embedded	AN1903	ICS protocol command changing device credentials or access codes from a source not on the approved security administration list, after which the device rejects legitimate control system components
Windows	AN2262	Security events 4723 or 4724 (password change or reset) on an ICS service or operator account by an account outside the credential administration role, followed by the ICS service failing to start or authenticate
Linux	AN2143	passwd or chpasswd run against an ICS service account outside the approved rotation workflow, from auditd records
Network Devices	AN2196	AAA password or SNMP community string changes from outside the approved network management subnet, followed by authentication failures from legitimate management systems

On field devices with little or no logging, the network is the main sensor: passive OT monitoring that decodes the vendor protocol can see a credential or configuration write, and a sudden loss of polling from SCADA to a device is a strong second signal. See the OT Network Security Monitoring Guide.

Measures worth tracking:

Default credential rate: percentage of devices still on default or unset credentials, from commissioning records and audits.
Vaulted coverage: percentage of device credentials held in the vault with a named owner.
Recovery readiness: percentage of critical device models with a documented, tested lockout recovery procedure and a spare.
Unexplained changes: credential changes without a matching change record, and time to resolve them.

Recovery planning and response

Plan recovery per device model before an incident, because the options differ: some devices accept a local reset, some need a factory reset that wipes the program, and some need the vendor. Write it down while you still have access.

Model by model: for each critical device type, record the vendor's documented recovery route for a lost or changed password and what it erases.
Keep what a reset erases: the approved program, configuration and network settings for each device, offline. See the OT Backup, Recovery and Golden Image Guide.
Hold spares: cold standby units for the models where recovery needs a vendor return.
Rehearse manual operation: the water utilities and the German building fell back to manual control; test how long you can run that way.
When it happens: confirm the process state with operations, switch to manual or local control where needed, preserve network captures and device state, block the source path, then restore from the stored configuration or replace the unit. Treat any locked device as possibly also running altered logic (T0889) until verified. Follow the OT Incident Response Guide.

Common failure patterns

Unset keys and default passwords left at commissioning: the attacker sets the credential first, as in the building automation and Polish cases.
Management interfaces reachable from the internet: cellular-connected PLCs and exposed UDP ports were the entry points in the recorded cases.
No record of how to recover each model: the team discovers during the incident that the vendor cannot help quickly.
Configurations not backed up: a factory reset restores access but leaves a blank device.
Shared device passwords across sites: one credential leak locks out every facility at once.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev 5	IA-5 Authenticator Management, CM-5 Access Restrictions for Change, CP-9 System Backup, CP-10 System Recovery and Reconstitution	Change defaults and manage device credentials, restrict who may change them, back up, recover
NIST CSF 2.0	PR.AA-01, PR.DS-11, RS.MI-01	Credentials for hardware managed, backups tested, incidents contained
ATT&CK for ICS mitigations	M0927, M0953, M0811	Password policies, data backup, redundancy of service

Practitioner checklist

Set every default or unset device password and programming key at commissioning, unique per device.
Keep device credentials in a vault with named access and a break-glass process.
Remove management interfaces from the internet and from IT networks; turn off unused web and FTP services.
Back up each device's configuration and program offline, with the credentials needed to restore it.
Document the vendor's lockout recovery route for every critical model, and hold spares where it needs a return.
Monitor for credential and configuration writes to field devices and for sudden loss of polling.
Collect Windows 4723 and 4724 events and auditd password changes for ICS service accounts.
Rehearse manual operation and device recovery at least once a year.

T0892 Change Credential: Preventing and Recovering From Operator Lockouts