Detection of Change Operating Mode

Real-time monitoring identifies an Industrial Control System (ICS) protocol mode-change command targeting a field device from a source not in the approved engineering workstation list, where the transition is not immediately followed by a corresponding operator acknowledgment. Documented in Triton (the Tricon controller had to be placed in PROGRAM mode before the attack could inject its payload). OT operational-fidelity gate: Alert only when the action is not attributable to an authorized operator/engineering source for the specific target and function, and it is either outside an approved change/maintenance window or lacks matching change-control context; where telemetry permits, require corroborating device, configuration, or process-state effect. Suppress activity that fully matches approved maintenance, commissioning, failover, recovery, or tested control procedures.