DC0111: Software
This includes sources of current and expected software or application programs deployed to a device, along with information on the version and patch level for vendor products, full source code for any application programs, and unique identifiers (e.g., hashes, signatures).
Analyst context for executives and security teams
This ICS ATT&CK data component is about knowing what software is deployed or expected on industrial devices, including versions, patch levels, source code where applicable, and unique identifiers such as hashes or signatures. For leaders, its value is not detection by itself; it is the evidence foundation for vulnerability prioritization, incident scoping, change assurance, audit readiness, and cyber-physical resilience.
Executive priority
Prioritize this as an asset and software visibility requirement for operational technology environments. Without reliable software inventory and version evidence, teams struggle to decide which industrial systems are exposed to a vulnerability, whether an incident changed trusted applications, or whether patch and compensating-control decisions are defensible. The business question is: can the organization prove what software should be present on critical devices, what version it is, and whether it has changed?
Technical view
SOC, IR, vulnerability management, and OT engineering teams should validate whether they have authoritative records of current and expected software on ICS devices, including vendor product versions, patch levels, approved application code, and hashes or signatures where available. Because the ATT&CK object provides no specific detection logic, platforms, tactics, or relationship context, this component should be treated as supporting telemetry for investigations, baselining, vulnerability assessment, and change validation rather than as a standalone analytic.
Likely telemetry
- OT asset inventory records showing installed software and application programs
- Vendor product version and patch-level data
- Approved software baselines for industrial devices
- Source code repositories or controlled engineering project files where applicable
- File hashes, digital signatures, or other unique software identifiers
Detection direction
- Validate that software inventory data is current enough to support incident response and vulnerability decisions in ICS environments.
- Compare observed software details against expected baselines, approved versions, patch levels, and known identifiers such as hashes or signatures.
- Tune alerting or review workflows around unauthorized software changes, unexpected versions, missing patch evidence, or software identifiers that do not match approved records.
- Account for false positives from legitimate maintenance windows, vendor updates, engineering changes, and incomplete inventory collection.
- Document blind spots where devices cannot be queried safely, software versions are manually tracked, or source code and hash evidence are unavailable.
Mitigation priorities
- Establish an authoritative software inventory for critical ICS devices and applications.
- Define expected software baselines, including approved versions, patch levels, and identifiers where feasible.
- Integrate software inventory with vulnerability management, change management, and incident response processes.
- Preserve evidence of approved source code, vendor packages, hashes, signatures, and maintenance records for audit and forensic use.
- Review gaps where legacy devices, vendor-managed systems, or safety constraints limit automated collection and define compensating validation methods.
Analyst notes and limits
This is a data component in the ICS ATT&CK domain, not a technique. Its defensive value comes from enabling other security functions: asset understanding, patch prioritization, change validation, and investigation scoping. Glexia would use this to test whether OT security operations and governance processes can produce reliable software evidence when a vulnerability, incident, or audit request occurs.
MITRE provides a description but no official detection text, platforms, tactics, or relationship context for this object. Any assessment of coverage, alerting quality, or operational risk requires local evidence from the organization’s ICS asset inventory, engineering records, vulnerability process, and incident response procedures.
Software
This includes sources of current and expected software or application programs deployed to a device, along with information on the version and patch level for vendor products, full source code for any application programs, and unique identifiers (e.g., hashes, signatures).
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | b1bee0a517cf… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack DC0111Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.