Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0843_program-download
Adversaries may perform a program download to transfer a user program to a controller.
Passed 16 of 22 test cases with the skill, and 10 of 22 without it.
and 3 more in the full report
6 fixed10 passed either way6 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
When legacy engineering software tools communicate with field controllers, spoofed applications can trigger program transfers. What mitigation control specifically enforces identity verification between client software applications and the physical controller?
| Checked | Without skill | With skill |
|---|---|---|
| Recommends M0813 Software Process and Device Authentication. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may perform a program download to transfer a user program to a controller.
Variations of program download, such as online edit and program append, allow a controller to continue running during the transfer and reconfiguration process without interruption to process control. However, before starting a full program download (i.e., download all) a controller may need to go into a stop state. This can have negative consequences on the physical process, especially if the controller is not able to fulfill a time-sensitive action. Adversaries may choose to avoid a download all in favor of an online edit or program append to avoid disrupting the physical process. An adversary may need to use the technique Detect Operating Mode or Change Operating Mode to make sure the controller is in the proper mode to accept a program download.
The granularity of control to transfer a user program in whole or parts is dictated by the management protocol (e.g., S7CommPlus, TriStation) and underlying controller API. Thus, program download is a high-level term for the suite of vendor-specific API calls used to configure a controllers user program memory space.
Modify Controller Tasking and Modify Program represent the configuration changes that are transferred to a controller via a program download.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Program Download by examining operational technology systems and network architecture.
Review whether mitigations for T0843 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Authenticate connections from software and devices to prevent unauthorized systems from accessing protected management functions.
test cases passed, vs 10 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.