MITRE ATT&CKsub-technique

T0873.001 Siemens Project File Format

Published 2026-04-20 Modified 2026-10-13 Official page ↗
Domain
ics
Tactics
Persistence
Platforms
Windows, Linux
Version
1.0
Created
2026-04-20

Description

Adversaries may infect Siemens PLC project files (i.e., Step 7, WinCC, etc.) to achieve Execution, Persistence, and Lateral Movement objectives. Adversaries may modify an existing project file or bring their own project files into the environment. The ability for an adversary to deploy an infected project file relies on access to a workstation with Siemens PLC programming software installed on it from which a program download can be performed.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T0873 Project File Infection technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (4)

  • M0941 Encrypt Sensitive Information mitigation
  • M0945 Code Signing mitigation
  • M0947 Audit mitigation
  • M0922 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · uses (1)

  • S0603 Stuxnet software (malware)

References