MITRE ATT&CKtechnique

T0800 Activate Firmware Update Mode

Published 2020-05-21 Modified 2026-10-13 Official page ↗
Domain
ics
Tactics
Inhibit Response Function
Platforms
Embedded, Windows, Linux, Network Devices
Version
1.0
Created
2020-05-21

Description

Adversaries may activate firmware update mode on devices to prevent expected response functions from engaging in reaction to an emergency or process malfunction. For example, devices such as protection relays may have an operation mode designed for firmware installation. This mode may halt process monitoring and related functions to allow new firmware to be loaded. A device left in update mode may be placed in an inactive holding state if no firmware is provided to it. By entering and leaving a device in this mode, the adversary may deny its usual functionalities.

Related

Tactic · MITRE ATT&CK (1)

  • TA0107 Inhibit Response Function tactic

Referenced by MITRE ATT&CK · mitigates (8)

  • M0800 Authorization Enforcement mitigation
  • M0801 Access Management mitigation
  • M0802 Communication Authenticity mitigation
  • M0804 Human User Authentication mitigation
  • M0937 Filter Network Traffic mitigation
  • M0807 Network Allowlists mitigation
  • M0930 Network Segmentation mitigation
  • M0813 Software Process and Device Authentication mitigation

Referenced by MITRE ATT&CK · uses (1)

  • S0604 Industroyer software (malware)