Detection of Manipulate I/O Image

Technique Detected:  Manipulate I/O Image | T0835

ID: DET0773
Domains: ICS
Analytics: AN1905
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1905

A manipulated I/O image requires analyzing the application program running on the PLC for specific data block writes. Detecting this requires obtaining and analyzing a PLC’s application program, either directly from the device or from asset management platforms.

Log Sources
Data Component Name Channel
Software (DC0111) Asset None