{
  "type": "attack-pattern",
  "spec_version": "2.1",
  "id": "attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2",
  "created": "2021-04-13T11:15:26.506Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": false,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T0889",
      "external_id": "T0889"
    },
    {
      "source_name": "IEC February 2013",
      "description": "IEC 2013, February 20 IEC 61131-3:2013  Programmable controllers - Part 3: Programming languages Retrieved. 2019/10/22 ",
      "url": "https://webstore.iec.ch/publication/4552"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2025-04-15T19:59:24.213Z",
  "name": "Modify Program",
  "description": "Adversaries may modify or add a program on a controller to affect how it interacts with the physical process, peripheral devices and other hosts on the network. Modification to controller programs can be accomplished using a Program Download in addition to other types of program modification such as online edit and program append. \n\nProgram modification encompasses the addition and modification of instructions and logic contained in Program Organization Units (POU)  (Citation: IEC February 2013) and similar programming elements found on controllers. This can include, for example, adding new functions to a controller, modifying the logic in existing functions and making new calls from one function to another. \n\nSome programs may allow an adversary to interact directly with the native API of the controller to take advantage of obscure features or vulnerabilities.",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-ics-attack",
      "phase_name": "persistence"
    }
  ],
  "x_mitre_attack_spec_version": "3.2.0",
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "ics-attack"
  ],
  "x_mitre_is_subtechnique": false,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_platforms": [
    "None"
  ],
  "x_mitre_version": "1.2"
}