Skip to main content
OT Atlas
Search

Hunt playbook

Unexpected Controller Mode Change

Find controllers transitioning between Run, Program, Stop or remote/local states without an approved reason.

FoundationalT0858

Hypothesis

A controller may have changed operating mode without authorisation.

Why this hunt matters

Mode changes both enable logic modification and can stop a process outright.

Scope

Assets: plc, pac, safety-plc, robot-controller

Protocols: s7comm, ethernet-ip, pccc, umas, fins, mc-protocol, ads-ams

Data sources required

  • Controller diagnostic logs
  • Protocol inspection for mode-change functions
  • SCADA/HMI status tags
  • Change records

Baseline needed first

  • Controllers remain in Run; keyswitches in the protected position; mode changes only during approved work

Hunt steps

  1. 01Collect mode-state history from SCADA tags or controller diagnostics
  2. 02List every transition in the period with timestamp
  3. 03Match each transition against change records and maintenance activity
  4. 04Identify the source host for network-initiated mode changes

Indicators of interest

  • Program mode outside a change window
  • Stop commands from unexpected hosts
  • Keyswitch state reported as remote-programmable
  • Siemens S7 CPU stop/start via 102/TCP job functions, or a protection-level change in the TIA Portal audit trail
  • Schneider Modicon CPU stop issued over UMAS (Modbus function code 90) on 502/TCP
  • Rockwell Logix mode change with the keyswitch reported in REM rather than RUN

Triage

  • Did production stop or degrade?
  • Was a download performed while in program mode?
  • Who initiated it?

Likely false positives

  • Commissioning and troubleshooting
  • Power cycles and hardware faults
  • Redundancy switchovers

Escalation

  • Safety controller mode change
  • Mode change followed by a program download

Containment options

  • Coordinate with operations before restoring mode — restarting logic can move equipment

Validation

  • Keyswitch discipline verified on site
  • Mode-change alarming configured

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.