Programmable controllers typically have several modes of operation that control the state of the user program and control access to the controllers API. Adversaries may change the operating mode of a controller to gain additional access to engineering functions such as Program Download. An adversary may use command-line interfaces (CLIs) to interact with systems and execute commands. The Oldsmar water treatment attack led to immediate operator detection as they were able to see the. adversary making changes on their screen.”]
Source: https://collaborate.mitre.org/attackics/index.php/Execution