Engineering workstation → push payload to PLC

§ Context

Assumed environment: foothold in corporate IT. Reach to the engineering workstation via shared-credential AD account / jump-host with weak segmentation. PLC programming software installed.

§ Steps

1. 01
   Process disruption / physical impactImpact

   T1486— Data Encrypted for Impact
2. 02
   Foothold in corporate ITInitial Access

   T1078— Valid Accounts
3. 03
   Download modified logic to PLCImpact

   OT-MODBUS-WRITE— Modbus TCP Write to PLC
4. 04
   Modify ladder logic / function blockImpact

   OT-S7-SIEMENS— Siemens S7 Protocol Abuse
5. 05
   Use installed TIA Portal / Studio 5000Lateral Movement

   OT-ENG-WORKSTATION— Engineering Workstation Pivot
6. 06
   Pivot to engineering workstationLateral Movement

   OT-IT-OT-PIVOT— IT → OT Network Pivot

§ References

• T1486Data Encrypted for Impact
• T1078Valid Accounts

§ Frequently asked

What is the "Engineering workstation → push payload to PLC" attack path?

Compromise the OT engineer's laptop (corporate-network adjacent, jumphost-reachable). Use legit engineering tools (TIA Portal / Studio 5000) to download attacker ladder logic to the PLC. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Process disruption / physical impact (T1486) — a impact primitive. Assumed environment: foothold in corporate IT.

What is the final impact of this kill-chain?

The final step lands on Pivot to engineering workstation (OT-IT-OT-PIVOT), which falls under Lateral Movement. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques4

  TRITON-class SIS reprogram → disable safety shutdown

  After OT-network foothold, reach a Triconex Safety Instrumented System. Download attacker logic that suppresses safety trips on a process that's about to be pushed past its safe envelope.

• Shared techniques2

  Leaked legacy VPN credential → ransomware (Colonial-class)

  A dormant VPN account whose password appeared in a third-party breach is still active, has no MFA enforced. Sign in, recon AD, deploy ransomware across the estate.

• Shared techniques2

  Reachable Modbus PLC → direct register override

  Modbus has no authentication. From a foothold on a reachable OT network, write to coils / holding registers directly with pymodbus.

• Shared techniques2

  HMI default credentials → operations disruption

  Wonderware / iFix HMI exposed to the corporate network with vendor-default credentials. Operators see attacker-controlled values + commands sent to PLCs through legit channels.

• Shared techniques2

  Open MQTT broker → smart-estate takeover

  Shodan-indexed MQTT broker on TCP/1883 with no auth. Subscribe to '#' to harvest every device topic; publish to relays/locks/lights/thermostats.