MITRE ATT&CKsub-technique
T0843.003 Program Append
- Domain
- ics
- Tactics
- Lateral Movement
- Platforms
- Embedded
- Version
- 1.0
- Created
- 2026-04-20
Description
Adversaries may execute a program append to a PLC to update parts of an existing program. It may or may not require stopping the PLC which may allow it to continue running during transfer and reconfiguration without interruption to process control. Adversaries may leverage this approach to minimize downtime and evade detection.
The ability to perform a program append to the PLC typically relies on access to a workstation with the vendor-specific PLC programming software installed.
Related
Subtechnique of · MITRE ATT&CK (1)
- T0843 Program Download technique
Tactic · MITRE ATT&CK (1)
- TA0109 Lateral Movement tactic
Referenced by MITRE ATT&CK · mitigates (10)
- M0800 Authorization Enforcement mitigation
- M0801 Access Management mitigation
- M0802 Communication Authenticity mitigation
- M0804 Human User Authentication mitigation
- M0937 Filter Network Traffic mitigation
- M0945 Code Signing mitigation
- M0947 Audit mitigation
- M0807 Network Allowlists mitigation
- M0930 Network Segmentation mitigation
- M0813 Software Process and Device Authentication mitigation
Referenced by MITRE ATT&CK · uses (1)
- C0030 Triton Safety Instrumented System Attack campaign