Skip to content

Change Operating Mode

Technique · ATTACK:ics:T0858

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:ics:T0858",
  "title": "Change Operating Mode",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T0858",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601",
  "external_id": "T0858",
  "domain": "ics",
  "created": "2020-05-21T17:43:26.506Z",
  "modified": "2026-10-13T17:48:42.391Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "execution",
    "evasion"
  ],
  "source_references": [
    {
      "source_name": "Machine Information Systems 2007",
      "url": "http://www.machine-information-systems.com/How_PLCs_Work.html"
    },
    {
      "source_name": "N.A. October 2017",
      "url": "https://forumautomation.com/t/what-are-the-different-operating-modes-in-plc/2489"
    },
    {
      "source_name": "Omron",
      "url": "https://www.omron-ap.com/service_support/FAQ/FAQ00002/index.asp#:~:text=In%20PROGRAM%20mode%2C%20the%20CPU,can%20be%20created%20or%20modified."
    },
    {
      "source_name": "PLCgurus 2021",
      "url": "https://www.plcgurus.net/plc-basics/"
    }
  ]
}

Explicit source assertions (10)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:ics:M0802 → mitigates → ATTACK:ics:T0858

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12a6c5bc-c685-4249-b8c6-e6d49aa2b9ed

ATTACK:ics:M0804 → mitigates → ATTACK:ics:T0858

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22448288-32d9-4d2c-be16-0784e119fff1

ATTACK:ics:S1045 → uses → ATTACK:ics:T0858

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51eb15a3-48af-470f-94c0-10f25b366d72

Dragos-Pipedream · Wylie-22

ATTACK:ics:S1009 → uses → ATTACK:ics:T0858

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74b66248-2cb6-46ea-b52c-c7d60c170f3f

ATTACK:ics:M0813 → mitigates → ATTACK:ics:T0858

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d5759cd-890e-4ec5-b92b-aba225d52960

ATTACK:ics:S1006 → uses → ATTACK:ics:T0858

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4c81fe6-1ad9-4bba-a415-a3c099eaa2be

Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016

ATTACK:ics:M0801 → mitigates → ATTACK:ics:T0858

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a86cee0a-dc49-4c95-b5dc-37405337490b

ATTACK:ics:M0807 → mitigates → ATTACK:ics:T0858

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab60fe4a-5860-410a-8bca-2cdbea95e5f8

Department of Homeland Security September 2016

ATTACK:ics:M0930 → mitigates → ATTACK:ics:T0858

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6e0ef82-2cb6-43fe-8f4a-b9e4d5a57b13

Department of Homeland Security September 2016

ATTACK:ics:M0800 → mitigates → ATTACK:ics:T0858

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eeeff03f-7436-4f76-8591-42075e6647d4

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.