{
  "node_id": "mitre-attack-ics-t1693-modify-firmware",
  "title": "MITRE ATT&CK ICS T1693: Modify Firmware (ICS Tactic TA0110 - Persistence)",
  "domain": "Cybersecurity",
  "version": "1.0.0",
  "last_updated": "2026-06-06",
  "bluf": "MITRE ATT&CK ICS T1693 (Modify Firmware) is an ICS Persistence, Inhibit Response Function, Impair Process Control technique. Firmware is low-level software embedded in hardware that enables systems and devices to function properly and is commonly found in ICS environments. Adversaries may modify firmware on a system or device by installing malicious or vulnerable versions that enable them to achieve objectives such as Persistence, Impair Process Control, and Inhibit Response Function. Adversaries may modify system and device firmware by using the built-in firmware update functionality which may support local or remote installation. The malicious or vulnerable firmware may be delivered via Replication Through Removable Media, Supply Chain Compromise, or Remote Services. Once installed, the malicious or vulnerable firmware could be used to provide Rootkit and Hooking functionality, Exploitation for Privilege Escal... Affected platforms: see ATT&CK ICS. ATT&CK-mapped mitigations: M0802 Communication Authenticity, M0930 Network Segmentation, M0945 Code Signing, M0807 Network Allowlists, M0808 Encrypt Network Traffic, M0947 Audit, M0804 Human User Authentication, M0813 Software Process and Device Authentication, M0946 Boot Integrity, M0941 Encrypt Sensitive Information, M0801 Access Management, M0937 Filter Network Traffic.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "iso_standard",
      "industry_mapping",
      "mitre_d3fend"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "nist-cybersecurity-framework-2-0",
    "iso-27001-2022",
    "nist-sp-800-53-r5",
    "cis-controls-v8",
    "mitre-attack-framework-v14"
  ],
  "primary_citations_count": 18
}