MITRE ATT&CKsub-technique

T0843.002 Online Edit

Published 2026-04-20 Modified 2026-10-13 Official page ↗
Domain
ics
Tactics
Lateral Movement
Platforms
Embedded
Version
1.0
Created
2026-04-20

Description

Adversaries may execute an online edit of a PLC to update parts of an existing program. It does not require stopping the PLC which allows it to continue running during transfer and reconfiguration without interruption to process control. Adversaries may leverage this approach to minimize downtime and evade detection. The ability to perform an online edit to the PLC typically relies on access to a workstation with the vendor-specific PLC programming software installed.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T0843 Program Download technique

Tactic · MITRE ATT&CK (1)

  • TA0109 Lateral Movement tactic

Referenced by MITRE ATT&CK · mitigates (10)

  • M0800 Authorization Enforcement mitigation
  • M0801 Access Management mitigation
  • M0802 Communication Authenticity mitigation
  • M0804 Human User Authentication mitigation
  • M0937 Filter Network Traffic mitigation
  • M0945 Code Signing mitigation
  • M0947 Audit mitigation
  • M0807 Network Allowlists mitigation
  • M0930 Network Segmentation mitigation
  • M0813 Software Process and Device Authentication mitigation