T0845: Program Upload
Adversaries may attempt to upload a program from a PLC to gather information about an industrial process. Uploading a program may allow them to acquire and study the underlying logic. Methods of program upload include vendor software, which enables the user to upload and read a program running on a PLC. This software can be used to upload the target program to a workstation, jump box, or an interfacing device.
Analyst context for executives and security teams
Program Upload is an ICS technique where an adversary attempts to copy control logic from a PLC or similar controller to a workstation, jump box, or interfacing device. For leaders, the issue is not just data theft: controller logic can reveal how an industrial process works, including safety or automation dependencies, which can shape later disruption or manipulation decisions.
Executive priority
Prioritize this behavior where PLCs, safety controllers, DCS controllers, or PACs support critical operations. Ask whether only approved, authenticated users and systems can read controller logic, whether uploads are logged or reviewed, and whether OT network paths limit who can reach embedded control assets. This is relevant to operational resilience, incident response scoping, and compliance evidence for access control and segmentation in industrial environments.
Technical view
ATT&CK provides no official detection text for T0845, but the relationship to DET0761 indicates a detection strategy exists for Program Upload. SOC, OT security, and IR teams should validate visibility into engineering software activity, controller read/upload operations, network sessions between workstations or jump boxes and controllers, and authentication or authorization decisions around controller access. Because tactics and platforms are not specified for the technique, detection engineering should be anchored to local asset inventories and the targeted asset relationships: PLCs, safety controllers, DCS controllers, and PACs.
Likely telemetry
- Engineering workstation or jump box activity involving vendor software used to read or upload controller programs
- Controller access logs or audit records showing program read/upload events where available
- Network traffic between workstations, interfacing devices, and embedded controllers
- Authentication and authorization records for users, devices, and software processes accessing controller logic
- OT firewall, gateway, allowlist, or protocol-filtering logs showing permitted or denied controller communications
Detection direction
- Validate whether DET0761-aligned monitoring can identify controller program upload behavior in the local environment.
- Baseline legitimate engineering and maintenance uploads so alerts can distinguish expected change activity from unusual source systems, users, timing, or controller targets.
- Correlate upload-like activity with access-control evidence; a permitted network session alone may not prove authorized logic access.
- Pay special attention to blind spots where legacy controllers lack native authentication, detailed audit logs, or user attribution.
- Use relationship context from Triton and INCONTROLLER only as evidence that known ICS software has used this technique; do not treat that relationship as proof of current activity.
Mitigation priorities
- Enforce authorization so only authenticated users with approved roles can read, manipulate, or execute controller functions, consistent with M0800 Authorization Enforcement.
- Use Access Management controls or gateways where field devices cannot sufficiently identify or authenticate users on their own.
- Require human user authentication and, where appropriate, device and software process authentication before allowing access to controller data or commands.
- Use communication authenticity protections when controller communications cross untrusted networks.
- Restrict reachable controller paths with network segmentation, network allowlists, and protocol-aware traffic filtering, especially around automation protocols and engineering access paths.
Analyst notes and limits
This technique targets embedded ICS control assets including PLCs, safety controllers, DCS controllers, and PACs. The supplied relationships list Triton and INCONTROLLER as software that use Program Upload; INCONTROLLER’s description includes downloading logic and interacting with ICS devices and protocols. Those relationships support threat-informed prioritization, but local logs, asset ownership, and maintenance procedures are required to determine whether observed uploads are authorized.
The ATT&CK object does not specify tactics, technique platforms, aliases, labels, or official detection text. The mitigation descriptions are relationship-derived and partially truncated in the supplied fields, so recommendations are limited to the named mitigation themes and provided descriptions. No claim is made about active exploitation, attribution, customer exposure, or guaranteed detection coverage.
Program Upload
Adversaries may attempt to upload a program from a PLC to gather information about an industrial process. Uploading a program may allow them to acquire and study the underlying logic. Methods of program upload include vendor software, which enables the user to upload and read a program running on a PLC. This software can be used to upload the target program to a workstation, jump box, or an interfacing device.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Groups, software, and campaigns
S1009: Triton
S1045: INCONTROLLER
INCONTROLLER is custom malware that includes multiple modules tailored towards ICS devices and technologies, including Schneider Electric and Omron PLCs as well as OPC UA, Modbus, and CODESYS protocols. INCONTROLLER has the ability to discover specific devices, download logic on the devices, and exploit platform-specific vulnerabilities. As of September 2022, some security researchers assessed INCONTROLLER was developed by CHERNOVITE.[1][2][3][4][5]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 8effb3bafbad… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack T0845Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.