Change Operating Mode T0858

ICS Tactics: Execution, Evasion

Authoring guide

These 4 rules share fields, values, and exclusions.

Fields filtered most (6 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
AlertName2contains 2an s7 stop plc command was sent, controller reset, controller stop, plc operating mode changed
DeviceProduct2eq 2isid
EventClassID2in 2114, 115, 116, 156, 161
ProviderName2eq 2IoTSecurity
isNew2eq 2True
EventMessage1contains 1unauthorized

Top indicator values (31 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
DeviceProducteq
isid
28
ProviderNameeq
IoTSecurity
215
isNeweq
True
215
AlertNamecontains
an s7 stop plc command was sent
1
AlertNamecontains
controller reset
1
AlertNamecontains
controller stop
1
AlertNamecontains
excessive restart rate of an outstation
1
AlertNamecontains
ge srtp stop plc command was sent
1
AlertNamecontains
outstation restarted
1
AlertNamecontains
outstation restarts frequently
1
AlertNamecontains
plc operating mode changed
1
AlertNamecontains
profinet device factory reset
1
AlertNamecontains
slave device unrecoverable failure
1
AlertNamecontains
suspicion of hardware problems in outstation
1
EventClassIDin
114
1
EventClassIDin
115
1
EventClassIDin
116
1
EventClassIDin
117
1
EventClassIDin
118
1
EventClassIDin
119
1
EventClassIDin
156
1
EventClassIDin
161
1
EventClassIDin
162
1
EventClassIDin
169
1
EventClassIDin
171
1
EventClassIDin
182
1
EventClassIDin
183
1
EventClassIDin
184
1
EventClassIDin
185
1
EventClassIDin
5
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Kusto 4 rules