This includes sources of current and expected software or application programs deployed to a device, along with information on the version and patch level for vendor products, full source code for any application programs, and unique identifiers (e.g., hashes, signatures).
| Name | Channel |
|---|---|
| Asset | None |
| assetinventory:ProgramDiff | current task-to-block assignment table differs from last known-good baseline without corresponding change ticket |
| assetinventory:ProgramHash | program hash differs from last authorized baseline without corresponding change ticket reference |
| ID | Name | Technique Detected |
|---|---|---|
| DET0741 | Detection of Modify Controller Tasking | T0821 |
| DET0783 | Detection of Modify Program | T0889 |