Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T0868: Detect Operating Mode

Adversaries may gather information about a PLCs or controllers current operating mode. Operating modes dictate what change or maintenance functions can be manipulated and are often controlled by a key switch on the PLC (e.g., run, prog [program], and remote). Knowledge of these states may be valuable to an adversary to determine if they are able to reprogram the PLC. Operating modes and the mechanisms by which they are selected often vary by vendor and product line. Some commonly implemented operating modes are described below:

* Program - This mode must be enabled before changes can be made to a devices program. This allows program uploads and downloads between the device and an engineering workstation. Often the PLCs logic Is halted, and all outputs may be forced off. [1] * Run - Execution of the devices program occurs in this mode. Input and output (values, points, tags, elements, etc.) are monitored and used according to the programs logic.Program Upload and Program Download are disabled while in this mode. [2] [3] [1] [4] * Remote - Allows for remote changes to a PLCs operation mode. [4] * Stop - The PLC and program is stopped, while in this mode, outputs are forced off. [3] * Reset - Conditions on the PLC are reset to their original states. Warm resets may retain some memory while cold resets will reset all I/O and data registers. [3] * Test / Monitor mode - Similar to run mode, I/O is processed, although this mode allows for monitoring, force set, resets, and more generally tuning or debugging of the system. Often monitor mode may be used as a trial for initialization. [2]

ICST0868TechniqueObject v1.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Detect Operating Mode is an ICS behavior where an adversary gathers the current mode of controllers such as PLCs, PACs, DCS controllers, or safety controllers. This matters because controller mode often determines whether logic can be changed, downloaded, uploaded, monitored, forced, reset, or stopped. For business leaders, the key risk is not the mode query alone; it is that mode awareness can help an intruder decide whether a control-system change is currently possible and which access path may matter most.

Executive priority

Prioritize this as an OT visibility and access-control question: can the organization prove who can read controller state, from where, and under what conditions? The behavior is especially relevant to operational resilience and safety because the ATT&CK relationships include PLCs, PACs, DCS controllers, and safety controllers. Executives should ask whether engineering workstations, remote access paths, and controller networks have enforceable authentication, segmentation, allowlisting, and protocol filtering, and whether SOC/IR teams can distinguish normal engineering activity from unusual mode discovery.

Technical view

MITRE provides no official detection text and no platform value for the technique, but it does identify embedded ICS assets as targets and DET0768 as a related detection strategy. SOC and OT teams should validate vendor- and product-line-specific ways that operating mode is exposed or queried, then baseline legitimate engineering workstation, HMI, maintenance, and commissioning activity. Investigations should focus on mode reads or controller-state discovery from unexpected hosts, unauthenticated or poorly attributed sessions, remote paths, or sequences that precede program upload/download, force, reset, stop, or other maintenance-capable actions. The relationship to Triton should be treated as ATT&CK context that this behavior is relevant to safety-controller interaction, not as evidence of current activity in any environment.

Likely telemetry

  • Controller or PLC/PAC/DCS/safety-controller communication logs where available
  • OT network packet capture or protocol metadata capable of identifying controller status or mode queries
  • Engineering workstation and maintenance laptop activity logs
  • Remote access, jump host, access gateway, and authentication logs for OT access paths
  • Asset inventory showing controller type, vendor/product line, current approved operating mode, and authorized engineering stations

Detection direction

  • Map DET0768 to local telemetry and confirm whether mode-query behavior can actually be observed for each controller family in scope.
  • Baseline normal mode monitoring by engineering tools and HMIs to reduce false positives during maintenance, commissioning, and troubleshooting windows.
  • Alert on mode discovery from non-engineering hosts, unusual remote sessions, new source addresses, unexpected network segments, or activity outside approved change windows.
  • Correlate mode queries with subsequent program upload, program download, reset, stop, force, or other maintenance-oriented operations when telemetry supports it.
  • Treat lack of protocol visibility as a material blind spot; flow logs alone may show access but may not prove whether operating mode was queried.

Mitigation priorities

  • Start with asset and access-path inventory for PLCs, PACs, DCS controllers, and safety controllers so defenders know where operating mode can be read or changed.
  • Enforce least-privilege authorization for read, manipulate, and execute privileges using Authorization Enforcement where supported.
  • Require Human User Authentication and Software Process and Device Authentication for access to controller data and commands where feasible in the ICS environment.
  • Use Access Management technologies or gateways where field devices cannot natively provide sufficient user identification or authentication.
  • Apply Network Segmentation, Network Allowlists, and protocol-aware Filter Network Traffic controls to restrict which systems can communicate with controllers and what application-layer actions are allowed.
Analyst notes and limits

Operating modes vary by vendor and product line. Program, run, remote, stop, reset, and test/monitor modes have different operational implications, and local engineering standards determine which mode reads are normal. The most useful defensive outcome is an evidence-backed list of authorized systems and users that can query or influence controller mode, plus SOC logic that distinguishes approved maintenance from unexpected discovery.

The supplied ATT&CK object does not specify tactics, platforms, or official detection logic. Detection and telemetry recommendations therefore require local validation against the organization’s controller vendors, protocols, engineering tools, and network architecture. No claim is made that this behavior is actively occurring or that any listed control guarantees detection or prevention.

Official MITRE ATT&CK definition

Detect Operating Mode

Adversaries may gather information about a PLCs or controllers current operating mode. Operating modes dictate what change or maintenance functions can be manipulated and are often controlled by a key switch on the PLC (e.g., run, prog [program], and remote). Knowledge of these states may be valuable to an adversary to determine if they are able to reprogram the PLC. Operating modes and the mechanisms by which they are selected often vary by vendor and product line. Some commonly implemented operating modes are described below:

* Program - This mode must be enabled before changes can be made to a devices program. This allows program uploads and downloads between the device and an engineering workstation. Often the PLCs logic Is halted, and all outputs may be forced off. [1] * Run - Execution of the devices program occurs in this mode. Input and output (values, points, tags, elements, etc.) are monitored and used according to the programs logic.Program Upload and Program Download are disabled while in this mode. [2] [3] [1] [4] * Remote - Allows for remote changes to a PLCs operation mode. [4] * Stop - The PLC and program is stopped, while in this mode, outputs are forced off. [3] * Reset - Conditions on the PLC are reset to their original states. Warm resets may retain some memory while cold resets will reset all I/O and data registers. [3] * Test / Monitor mode - Similar to run mode, I/O is processed, although this mode allows for monitoring, force set, resets, and more generally tuning or debugging of the system. Often monitor mode may be used as a trial for initialization. [2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Relationship explorer

All related ATT&CK context

mitigates · Mitigation M0813: Software Process and Device Authentication ICS targets · ICS Asset A0003: Programmable Logic Controller (PLC) ICS mitigates · Mitigation M0804: Human User Authentication ICS mitigates · Mitigation M0937: Filter Network Traffic ICS mitigates · Mitigation M0801: Access Management ICS mitigates · Mitigation M0802: Communication Authenticity ICS targets · ICS Asset A0010: Safety Controller ICS uses · Malware S1009: Triton ICS mitigates · Mitigation M0807: Network Allowlists ICS mitigates · Mitigation M0800: Authorization Enforcement ICS targets · ICS Asset A0018: Programmable Automation Controller (PAC) ICS detects · Detection Strategy DET0768: Detection of Detect Operating Mode ICS mitigates · Mitigation M0930: Network Segmentation ICS targets · ICS Asset A0017: Distributed Control System (DCS) Controller ICS
Mitigations

Mitigation direction

Mitigation ICS

M0813: Software Process and Device Authentication

Require the authentication of devices and software processes where appropriate. Devices that connect remotely to other systems should require strong authentication to prevent spoofing of communications. Furthermore, software processes should also require authentication when accessing APIs.

Mitigation ICS

M0804: Human User Authentication

Require user authentication before allowing access to data or accepting commands to a device. While strong multi-factor authentication is preferable, it is not always feasible within ICS environments. Performing strong user authentication also requires additional security controls and processes which are often the target of related adversarial techniques (e.g., Valid Accounts, Default Credentials). Therefore, associated ATT&CK mitigations should be considered in addition to this, including Multi-factor Authentication, Account Use Policies, Password Policies, User Account Management, Privileged Account Management, and User Account Control.

Mitigation ICS

M0937: Filter Network Traffic

Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic. Perform inline allow/denylisting of network messages based on the application layer (OSI Layer 7) protocol, especially for automation protocols. Application allowlists are beneficial when there are well-defined communication sequences, types, rates, or patterns needed during expected system operations. Application denylists may be needed if all acceptable communication sequences cannot be defined, but instead a set of known malicious uses can be denied (e.g., excessive communication attempts, shutdown messages, invalid commands). Devices performing these functions are often referred to as deep-packet inspection (DPI) firewalls, context-aware firewalls, or firewalls blocking specific automation/SCADA protocol aware firewalls. [1]

Mitigation ICS

M0801: Access Management

Access Management technologies can be used to enforce authorization polices and decisions, especially when existing field devices do not provide sufficient capabilities to support user identification and authentication. [1] These technologies typically utilize an in-line network device or gateway system to prevent access to unauthenticated users, while also integrating with an authentication service to first verify user credentials. [2]

Mitigation ICS

M0802: Communication Authenticity

When communicating over an untrusted network, utilize secure network protocols that both authenticate the message sender and can verify its integrity. This can be done either through message authentication codes (MACs) or digital signatures, to detect spoofed network messages and unauthorized connections.

Mitigation ICS

M0807: Network Allowlists

Network allowlists can be implemented through either host-based files or system hosts files to specify what connections (e.g., IP address, MAC address, port, protocol) can be made from a device. Allowlist techniques that operate at the application layer (e.g., DNP3, Modbus, HTTP) are addressed in Filter Network Traffic mitigation.

Mitigation ICS

M0800: Authorization Enforcement

The device or system should restrict read, manipulate, or execute privileges to only authenticated users who require access based on approved security policies. Role-based Access Control (RBAC) schemes can help reduce the overhead of assigning permissions to the large number of devices within an ICS. For example, IEC 62351 provides examples of roles used to support common system operations within the electric power sector [1], while IEEE 1686 defines standard permissions for users of IEDs. [2]

Mitigation ICS

M0930: Network Segmentation

Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Restrict network access to only required systems and services. In addition, prevent systems from other networks or business functions (e.g., enterprise) from accessing critical process control systems. For example, in IEC 62443, systems within the same secure level should be grouped into a zone, and access to that zone is restricted by a conduit, or mechanism to restrict data flows between zones by segmenting the network. [1] [2]

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.0
Created
Modified
Raw hash
736eae98e64a9378...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.0 Current bundle 736eae98e64a…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    N.A. October 2017

    N.A. 2017, October What are the different operating modes in PLC? Retrieved. 2021/01/28

    Open source URL
  2. [2]
    Omron

    Omron Machine Information Systems 2007 How PLCs Work Retrieved. 2021/01/28 PLC Different Operating Modes Retrieved. 2021/01/28

    Open source URL
  3. [3]
    Machine Information Systems 2007

    Machine Information Systems 2007 How PLCs Work Retrieved. 2021/01/28

    Open source URL
  4. [4]
    PLCgurus 2021

    PLCgurus 2021 PLC Basics Modes Of Operation Retrieved. 2021/01/28

    Open source URL
  5. [5]
    mitre-attack T0868
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use