ATT&CK for ICS Collection Tactic Guide: Spot Process Reconnaissance Before It Becomes an Attack

Collection is the ATT&CK for ICS tactic in which an adversary gathers the process knowledge it needs to build a physical attack: tag lists, controller logic, operating modes, HMI screens and engineering drawings. MITRE describes TA0100 as the adversary "trying to gather data of interest and domain knowledge on your ICS environment to inform their goal". Unlike collection in an IT intrusion, the goal is rarely the data itself. It is the understanding of how a specific plant works, so that later manipulation, inhibition and impact techniques hit the right registers at the right time. This hub covers all 11 techniques that ATT&CK v20 lists under the tactic, how they chain into real attacks, which mitigations MITRE maps across them, and the detection patterns that separate hostile collection from the constant legitimate polling of a SCADA system. It is written for OT security engineers, control engineers and SOC analysts covering industrial sites, and builds on the MITRE ATT&CK for ICS Guide rather than repeating the matrix overview.

Key takeaways

• Collection is attack preparation, not theft. Program uploads, tag enumeration and I/O image capture tell an adversary which values to change, which is why Stuxnet recorded the I/O image before replaying it.
• Eleven techniques, one dominant pattern. Most of them are read operations over native industrial protocols, so they look like normal SCADA polling unless you know who is allowed to poll what.
• Source matters more than volume. ATT&CK v20 analytics for the tactic all hinge on reads from a host that is not an approved control server or engineering workstation, or reads that cover a full address space instead of the usual sparse tag set.
• Three techniques have no effective preventive mitigation. MITRE marks Monitor Process State (T0801), Screen Capture (T0852) and I/O Image (T0877) with M0816 Mitigation Limited or Not Effective, so detection and earlier access control carry the load.
• Engineering data lives on IT systems too. Data from Information Repositories (T0811) and Data from Local System (T0893) hit file shares, historians and AutoCAD drawings, so identity controls on engineering accounts and document stores are part of OT defence.

What Collection means on an industrial site

MITRE notes that Collection is often performed as part of Discovery (TA0102), and that the information gathered can span system, supervisory, device and network data, from plant-wide historian repositories down to device-specific programs. In practice the tactic answers four questions for an adversary:

• What is the process doing now? Monitor Process State (T0801) and I/O Image (T0877) read live values, which an attacker can use to time an action or, as with Stuxnet, record normal values to replay later.
• What does each value mean? Point & Tag Identification (T0861) maps addresses and tag names to physical equipment. Without it, an attacker writing to a PLC is guessing.
• How is the controller programmed and protected? Program Upload (T0845) pulls the running logic, and Detect Operating Mode (T0868) checks whether a controller is in run, program or remote mode, which decides whether it will accept a download.
• How was the plant designed? Data from Information Repositories (T0811), Data from Local System (T0893) and Screen Capture (T0852) collect drawings, project files, configuration and HMI screens that reveal the process layout.

Adversary-in-the-Middle (T0830), Automated Collection (T0802) and Wireless Sniffing (T0887) are delivery methods: they intercept traffic, script the collection at scale or capture radio links. Wireless Sniffing is also listed under Discovery. See the T0887 Wireless Sniffing guide.

Every technique in the tactic (ATT&CK v20)

The table lists all 11 techniques ATT&CK v20 places under TA0100, checked against the v20 STIX data and the live tactic page in November 2026. The examples are software, groups and campaigns that ATT&CK records as using each technique.

The technique pages linked in the table go deeper on each one: protocol detail, the full detection strategy and per-technique hardening.

How adversaries chain Collection

To see how the tactic is used in real intrusions, NHI Mgmt Group counted the groups, software and campaigns in the ATT&CK for ICS v20 STIX data that have at least one "uses" relationship to an ICS technique (41 in total, revoked and deprecated objects excluded). Of those, 16 use at least one Collection technique. Across those 16, the other tactics they also use most often are Execution, Impact, Impair Process Control, Discovery and Inhibit Response Function. Collection rarely appears alone: it sits between gaining access and acting on the process.

The lesson for defenders is timing. Collection usually happens days or weeks before impact, and it generates network reads from unusual sources. It is one of the last points at which an intrusion can be caught before the process is touched. See the ICS Malware History Guide for the families above.

Which techniques to prioritise

Not every technique carries the same risk or the same chance of detection. A practical order for a typical site:

1. Program Upload (T0845): a copy of controller logic is the single most valuable artefact for a targeted attack, and the read-back is a distinct protocol session with a large byte count. It is detectable and preventable with controller passwords, run mode and allowlists.
2. Point & Tag Identification (T0861) and Automated Collection (T0802): full-namespace browsing and register sweeps are rare in normal operations, where SCADA polls a fixed, sparse set of tags.
3. Detect Operating Mode (T0868): reads narrowly targeting mode or status registers from a new source are a strong sign that someone is checking whether a controller can be reprogrammed.
4. Data from Information Repositories (T0811) and Data from Local System (T0893): these run on Windows and Linux servers where host logging already exists, so the detection cost is low.
5. Adversary-in-the-Middle (T0830): less common but high consequence, since the same position allows modification of traffic.
6. Monitor Process State (T0801), I/O Image (T0877) and Screen Capture (T0852): hard to prevent at the device, so focus on stopping the access that makes them possible and on host-level detection of screenshot tools on HMIs.

Mitigations MITRE maps across the tactic

Counting the mitigation relationships in the v20 data shows that a short list of controls covers most of the tactic. The counts below are the number of Collection techniques each mitigation is mapped to.

The pattern is clear: segmentation, allowlists and device authentication cover the protocol-based techniques, while file permissions, encryption and account management cover the host and repository techniques. For the IT side of these mitigations see ATT&CK Mitigations.

Detection and measurement

Each technique has a detection strategy in ATT&CK v20. The analytics share an "OT operational-fidelity gate": MITRE explicitly warns not to alert on novelty, scan or read volume alone, because legitimate SCADA polling produces exactly that. Alerts should combine an unusual source with an unusual scope.

The precondition for most of these is an allowlist of who legitimately reads what. Build it from passive monitoring before writing rules. See the OT Network Security Monitoring Guide and the OT Asset Visibility Guide.

Metrics that show coverage:

• Percentage of controllers for which the set of approved reading hosts is documented and enforced (target 100% for safety and critical controllers).
• Number of program upload sessions per month that do not match a change or maintenance ticket (target zero).
• Percentage of the 11 Collection techniques with a tested detection rule in the OT SOC.
• Percentage of engineering document stores with object access auditing and named-account access only.
• Time from a test tag enumeration in a purple team exercise to analyst triage.

Where identity fits

Collection is often carried out with legitimate credentials and trusted machines. Program uploads run through vendor engineering software on a workstation that already holds controller access; historian and repository reads run under service accounts or engineering user accounts; OPC browsing uses the same client identity as the HMI.

• Engineering accounts: named, MFA-protected at the jump host and scoped per area, so a compromised account cannot read every controller on site. See the OT and ICS Identity and Access Guide.
• Service accounts: historian collectors and OPC servers should have read rights only to the tags they need, and their logons should be confined to their own hosts.
• Controller credentials: where controllers support read protection or passwords for program upload, turn them on and vault the passwords. MITRE maps M0813 and M0804 to Program Upload for this reason.
• Vendor access: brokered, recorded and time-bound sessions so a vendor connection cannot quietly pull project files. See the OT Remote Access Guide.

Implementation roadmap

1. Inventory readers: use passive monitoring for two to four weeks to record which hosts read from which controllers, using which protocol functions.
2. Agree the allowlist with operations: confirm each reader with the control engineers. Unknown readers are findings in their own right.
3. Alert in listen-only mode first: deploy rules for program upload, full namespace browse and register sweeps from non-allowlisted sources. Tune for several weeks before routing alerts to the SOC on-call.
4. Enforce at the conduit: apply network allowlists and protocol-aware filtering that block upload and browse functions from unapproved zones. Pilot on one non-critical cell, keep the previous rule set ready to restore, and agree a rollback trigger with operations.
5. Harden controllers and repositories: enable controller passwords and run mode, restrict engineering document stores to named accounts, and turn on object access auditing.
6. Exercise: run a purple team test of program upload and tag enumeration from a non-approved host and measure time to detection.

Decision guidance: small sites with flat networks get most value from segmentation of the controller network, controller passwords and a single passive sensor watching the controller switch. Large operators should centralise the reader allowlists and detection content and track per-site coverage of the 11 techniques. Where legacy controllers cannot authenticate reads, accept that M0813 is not available and compensate with stricter allowlists and monitoring.

Framework mapping

NIST SP 800-82 Rev. 3 provides the OT overlay for SP 800-53. See the NIST SP 800-82 OT Security Guide and the IEC 62443 Guide.

Common failure patterns

• Treating reads as harmless: rules that alert only on writes miss the program upload and tag enumeration that come first.
• Alerting on volume alone: SCADA polling is high volume by design. Rules without a source allowlist drown the SOC and get switched off.
• Project files on shared drives: controller projects and P&ID drawings on broadly accessible corporate shares give an adversary the process design without touching OT.
• Controller passwords left off: many controllers support upload protection that is not enabled at commissioning.
• Remote access tools on HMIs: VNC or remote desktop on an HMI, reachable from wide address ranges, turns screen capture into a remote capability.
• Wireless links assumed private: unencrypted radio telemetry between remote sites can be captured without any network access.

Practitioner checklist

• Approved reading hosts per controller are documented and enforced at the conduit.
• Program upload and full namespace browse from non-approved hosts raise an alert.
• Controllers run in run mode with upload protection or passwords enabled where supported.
• Engineering drawings and project files sit in a restricted store with object access auditing.
• Historian and OPC service accounts have read rights limited to the tags they need.
• Screenshot tools and remote display services on HMIs are removed or monitored.
• Radio links carrying control or telemetry traffic are encrypted and their propagation limited.
• Detection mappings use ATT&CK v20 technique and detection strategy IDs.
• Purple team tests of the Collection techniques run at least yearly, with time to detect recorded.

Standards and references

• MITRE ATT&CK for ICS: Collection (TA0100)
• MITRE ATT&CK for ICS: Discovery (TA0102)
• MITRE ATT&CK: Stuxnet (S0603)
• MITRE ATT&CK: Backdoor.Oldrea (S0093)
• MITRE: ATT&CK STIX Data
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• NIST: SP 800-53 Rev. 5, Security and Privacy Controls
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · ATT&CK for ICS Inhibit Response Function Tactic Guide · PLC Security Guide · Engineering Workstation Security Guide · Industrial Protocol Security Guide