Module Firmware `T0839`

ICS Tactics: Persistence, Impair Process Control

Authoring guide

These 1 rule share fields, values, and exclusions.

Fields filtered most (4 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`AlertName`	1	`contains` 1	`Foxboro I/A Unauthorized Operation`, `Function Code Raised Unauthorized Exception`, `GOOSE Message Type Settings`
`ExtendedProperties`	1	`contains` 1	`Beckhoff AMS Command Failure`, `Illegal Beckhoff AMS Command`
`ExtendedProperties.isNew`	1	`eq` 1	`True`
`ProviderName`	1	`eq` 1	`IoTSecurity`

Top indicator values (63 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`AlertName`	`contains`	`Foxboro I/A Unauthorized Operation` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`Function Code Raised Unauthorized Exception` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`GOOSE Message Type Settings` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`Modbus Address Range Violation` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`New Activity Detected - CIP Class` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`New Activity Detected - CIP Class Service` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`New Activity Detected - CIP PCCC Command` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`New Activity Detected - CIP Symbol` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`New Activity Detected - EtherNet/IP I/O Connection` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`New Activity Detected - EtherNet/IP Protocol Command` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`New Activity Detected - GSM Message Code` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`New Activity Detected - LonTalk Command Codes` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`New Activity Detected - LonTalk Network Variable` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`New Activity Detected - Ovation Data Request` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`New Activity Detected - Read/Write Command (AMS Index Group)` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`New Activity Detected - Read/Write Command (AMS Index Offset)` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`New Activity Detected - Unauthorized DeltaV Message Type` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`New Activity Detected - Unauthorized DeltaV ROC Operation` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`New Activity Detected - Using AMS Protocol Command` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`New Activity Detected - Using Siemens SICAM Command` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`New Activity Detected - Using Suitelink Protocol command` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`New Activity Detected - Using Suitelink Protocol sessions` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`New Activity Detected - Using Yokogawa VNetIP Command` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`Omron FINS Unauthorized Command` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`Sampled Values Message Type Settings` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`Toshiba Computer Link Unauthorized Command` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`Unauthorized ABB Totalflow File Operation` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`Unauthorized ABB Totalflow Register Operation` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2
`AlertName`	`contains`	`Unauthorized Access to Siemens S7 Data Block` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1
`AlertName`	`contains`	`Unauthorized Access to Siemens S7 Plus Object` kustoUnauthorized PLC changes (Microsoft Defender for IoT)	1	2

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Cross-platform

Domain: Endpoint

Kusto 1 rule