Most industrial intrusions recorded in MITRE ATT&CK for ICS did not need an exotic exploit to get in: they used a remote access path, an exposed device or a trusted third party that the asset owner had left open. ATT&CK for ICS describes the Initial Access tactic (TA0108) as the adversary "trying to get into your ICS environment", and stresses that footholds often sit on devices and communication paths with privileges in both IT and OT, or arrive through vendors, integrators and maintenance staff. This guide covers all 12 Initial Access techniques in ATT&CK v20, how real campaigns chained them into impact, which ones deserve defensive attention first, the mitigations MITRE maps across the tactic and the v20 detection strategies that catch them. It is written for OT security engineers, control system owners, SOC analysts covering industrial sites and the people who run vendor remote access. It builds on the MITRE ATT&CK for ICS Guide and does not repeat the matrix overview.
Key takeaways
- Remote access is the dominant entry route. Remote Services (T0886) has the most recorded procedure examples of any Initial Access technique in v20 (8), and External Remote Services (T0822) and Internet Accessible Device (T0883) add 4 each.
- Weak authentication turns exposure into access. The Unitronics defacements, the 2026 U.S. water utility attacks and the 2025 Poland wiper attacks all paired an exposed path with default or stolen credentials, not a zero-day.
- Segmentation is the most widely mapped control. Network Segmentation (M0930) is mapped to 7 of the 12 techniques, followed by Update Software (M0951) on 5.
- Third parties are part of the attack surface. Supply Chain Compromise (T0862), Transient Cyber Asset (T0864) and Replication Through Removable Media (T0847) all arrive through vendors, contractors and their equipment.
- Initial Access is where an OT defender has the most leverage. Once an adversary holds an engineering session, later tactics such as Modify Program or Inhibit Response Function use legitimate functions that are much harder to separate from normal work.
Where Initial Access sits in an ICS intrusion
In ATT&CK for ICS, Initial Access means reaching the ICS environment itself, not merely the corporate network. Many campaigns therefore show two entries: an enterprise intrusion (phishing, a watering hole, a stolen VPN credential) followed by a second crossing into OT through a remote service, a dual-homed host or a jump server. MITRE's tactic description names the routes explicitly: compromise of OT assets, IT resources in the OT network, external remote services and websites, trusted third parties, and outside devices such as radios, controllers or removable media.
To see how the tactic chains, we counted the "uses" relationships in the official ATT&CK v20 ICS dataset (ics-attack-20.0.json; groups, software and campaigns, excluding revoked and deprecated objects). 25 distinct entities have at least one Initial Access procedure: 10 software families, 8 groups and 7 campaigns, with 40 procedure examples between them. The campaign records show three repeating chains.
| Chain | Recorded example in ATT&CK v20 | What followed the entry |
|---|---|---|
| Stolen enterprise credentials into OT remote access | 2015 Ukraine Electric Power Attack (C0028): Sandworm Team used valid accounts taken from the Windows domain controller to reach the control system VPN (T0822), then remote services (T0886) | Remote operation of HMIs to open breakers, firmware overwrites on serial-to-Ethernet gateways |
| Compromised edge device, then IT remote protocols into OT | 2025 Poland Wiper Attacks (C0063): initial access through compromised Fortinet edge devices, then SSH, RDP and SMB/Windows Admin Shares (T0886) | Default credentials on RTUs, relays and serial servers; corrupted RTU firmware causing a reboot loop |
| Internet-exposed controller with weak credentials | Unitronics Defacement Campaign (C0031) and 2026 U.S. Water Utilities Attacks (C0066): internet accessible PLCs reached directly (T0883) | Default credentials, altered control logic and HMI defacement |
| Physical and radio access by an insider with equipment | Maroochy Water Breach (C0020): radio access (T0860), a computer with engineering software (T0864), external remote services and a rogue master (T0848) | False commands to pumping stations |
The pattern matters for prioritisation: in every chain above, the entry used a function that the asset owner had deliberately provided (a VPN, a remote programming port, a radio link, engineering software). Defending Initial Access in OT is mostly about governing those intended paths, not about blocking unknown ones.
The techniques in ATT&CK v20
ATT&CK v20 lists 12 techniques under Initial Access for ICS, with no sub-techniques. Two of them, Exploitation of Remote Services and Remote Services, also sit under Lateral Movement. Procedure counts are the number of groups, software and campaigns that ATT&CK records as using the technique.
| ID | Technique | Procedure examples | Assets MITRE lists as targets (selection) | Also under |
|---|---|---|---|---|
| T0817 | Drive-by Compromise | 5 | Workstation | |
| T0819 | MITRE ATT&CK for ICS T0819 Exploit Public-Facing Application | 1 | Application server, VPN server, firewall, workstation | |
| T0822 | External Remote Services | 4 | VPN server, jump host, data historian, firewall, DCS controller | |
| T0847 | MITRE ATT&CK for ICS T0847 Replication Through Removable Media | 2 | HMI, engineering workstation, PLC, RTU, safety controller | |
| T0848 | T0848 Rogue Master | 1 | RTU, PLC, IED, control server | |
| T0860 | ICS T0860 Wireless Compromise | 1 | Field I/O, workstation | |
| T0862 | MITRE ATT&CK for ICS T0862 Supply Chain Compromise | 3 | Almost every asset class, from field I/O to safety controllers | |
| T0864 | T0864 Transient Cyber Asset | 1 | Workstation | |
| T0865 | T0865 Spearphishing Attachment | 6 | Workstation, jump host | |
| T0866 | MITRE ATT&CK for ICS T0866 Exploitation of Remote Services | 4 | HMI, historian, jump host, PLC, safety controller | Lateral Movement |
| T0883 | Internet Accessible Device | 4 | Firewall, VPN server, switch, application server | |
| T0886 | Remote Services | 8 | Control server, HMI, historian, jump host, DCS controller | Lateral Movement |
How the techniques differ
- T0883 versus T0819: MITRE separates reaching an exposed device without an exploit (T0883, for example logging in to a PLC's remote programming port) from exploiting a vulnerability in exposed software (T0819, such as Sandworm Team's exploitation of internet-facing HMI products).
- T0822 versus T0886: External Remote Services covers the gateway from outside (VPN, Citrix, vendor portals); Remote Services covers RDP, SMB, SSH and vendor protocols used to move onto ICS hosts once on the network. Stolen credentials frequently join the two.
- T0866: exploitation of a service such as SMBv1; WannaCry, NotPetya and Bad Rabbit are recorded as crossing from IT into industrial networks this way.
- T0847, T0864 and T0862: entry through things brought in by people: USB drives (Stuxnet, Conficker at a nuclear power plant), laptops and engineering kits, and trojanised vendor installers (Dragonfly and Backdoor.Oldrea).
- T0848 and T0860: entry at the field level through radio and protocol impersonation, where an attacker never touches a Windows host.
Which techniques matter most for defenders
Procedure counts show what has been observed, not what will happen next, so we weigh them against how many asset classes each technique reaches and how directly it leads to process impact.
- Remote access paths (T0822, T0886, T0883): 16 of the 40 procedure examples, and the entry for every recent destructive campaign in the dataset. They hand the adversary an interactive session with the same tools operators use. See the OT Remote Access Guide.
- Enterprise to OT crossings (T0865, T0817, T0866): phishing and watering holes are how groups such as ALLANITE, OilRig and Dragonfly gained the credentials later used against OT; wormable exploitation is how ransomware arrives uninvited.
- Trusted third parties (T0862, T0864, T0847): few procedure examples, but they bypass network perimeters entirely and reach air-gapped sites. See the OT Third-Party and Integrator Access Guide.
- Field level entry (T0848, T0860): lower likelihood for most operators, but high consequence for utilities with radio telemetry and wide-area SCADA.
Mitigations MITRE maps to the tactic
ATT&CK v20 maps 32 distinct ICS mitigations to the 12 Initial Access techniques. The table lists those mapped to two or more techniques, which is where one control investment reduces several entry routes.
| Mitigation | Techniques mapped (v20) | What it means in an OT environment |
|---|---|---|
| M0930 Network Segmentation | T0819, T0822, T0848, T0864, T0866, T0883, T0886 | IT and OT separated with an industrial DMZ; no direct internet or corporate path to Level 0 to 2 assets. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide. |
| M0951 Update Software | T0817, T0819, T0862, T0864, T0866 | Patch exposed and boundary systems first, using vendor-qualified updates. See the OT Patch Management Guide. |
| M0813 Software Process and Device Authentication | T0848, T0860, T0886 | Authenticate masters, devices and engineering tools, for example OPC UA application certificates with trust lists |
| M0916 Vulnerability Scanning | T0819, T0862, T0866 | Passive or carefully scheduled active scanning of boundary and Level 3 systems |
| M0942 Disable or Remove Feature or Program | T0822, T0847, T0866 | Remove unused remote services, disable autorun and legacy SMB |
| M0950 Exploit Protection and M0948 Application Isolation and Sandboxing | T0817, T0819, T0866 | Exploit mitigation on engineering and HMI hosts, isolated browsing away from OT workstations |
| M0947 Audit | T0862, T0864 | Integrity checks on vendor software and transient devices before use |
| M0802 Communication Authenticity | T0848, T0860 | Authenticated protocol variants such as DNP3 Secure Authentication where supported |
| M0927 Password Policies and M0918 User Account Management | T0822, T0886 | Unique passwords, no shared vendor accounts, dormant accounts removed |
| M0937 Filter Network Traffic and M0807 Network Allowlists | T0848, T0886 | Only approved engineering workstations may reach controller programming ports |
| M0949 Antivirus/Antimalware | T0864, T0865 | Scanning kiosks for media and laptops, mail filtering for staff with OT access |
| M0926 Privileged Account Management | T0819, T0866 | Service accounts on exposed systems hold the least privilege possible |
| M0921 Restrict Web-Based Content | T0817, T0865 | No general web browsing or email from OT workstations |
Multi-factor Authentication (M0932) is mapped only to T0822 in the dataset, but it is the control that would have broken the credential-led chains above. CISA, FBI, EPA and DOE make the same point in their primary mitigations for OT: remove internet exposure, change default passwords, put any necessary remote access behind a private connection or VPN with phishing-resistant MFA, segment IT from OT with a DMZ, and keep the ability to operate manually. For the cross-tactic view of every mitigation, see ATT&CK Mitigations.
Detection and measurement
Every Initial Access technique in v20 has a detection strategy with analytics for Windows, Linux, network flow and OT protocol content. Most analytics share one idea: an ICS asset accepting a connection, session or file from a source outside an approved baseline (the approved engineering workstations, jump hosts, vendor session profiles and USB device IDs).
| Technique | v20 detection strategy | Log sources named in the analytics | Signal |
|---|---|---|---|
| T0822 External Remote Services | DET0803 | VPN authentication and application logs, NetFlow/IPFIX, Windows Security logon events, SSH auth logs | ICS-role account authenticating from an unusual geolocation or ASN, or a vendor session touching hosts outside its documented profile |
| T0883 Internet Accessible Device | DET0796 | Perimeter firewall logs, NSM connection logs, Windows Security, syslog auth | Inbound connections to ICS protocol ports or device management interfaces from internet-routed addresses |
| T0886 Remote Services | DET0804 | Windows Security logon events, Sysmon network and process events, NetFlow, NSM | East-west remote service connections not in the approved communication matrix; device-to-device ICS traffic |
| T0847 Removable Media | DET0733 | Sysmon file and process creation, System drive events, auditd, switch syslog | USB device ID not on the allowlist, followed by execution from the mounted path |
| T0848 Rogue Master | DET0792 | Asset inventory of master addresses, OT protocol content, device alarms | Master-role command traffic from a source not in the control server inventory |
| T0865 Spearphishing Attachment | DET0781 | Sysmon process creation, auditd | Office or mail client spawning a script interpreter on an engineering or operator workstation |
| T0862 Supply Chain Compromise | DET0730 | File integrity hash comparison, firmware hash inventory, network device syslog | Vendor package or firmware that deviates from the published manifest or hash |
Metrics that show it is working
- Internet exposure: number of OT assets reachable from the internet, from an external attack surface scan, trending to zero.
- Remote access coverage: share of remote OT sessions (staff and vendor) that pass through a brokered, MFA-protected and recorded path.
- Default credentials: share of controllers, HMIs and network devices confirmed to have no default or shared passwords.
- Communication matrix coverage: share of OT zones whose allowed flows are documented and alerted on when violated.
- Media control: share of removable media and transient devices scanned at a kiosk before connection.
- Time to revoke: hours from a vendor engagement ending to its remote access accounts being disabled.
Where identity fits
Credentials are the thread through this tactic. Remote access gateways, jump hosts, vendor portals and controller programming ports all decide access on an account, a password or a certificate, and the recorded campaigns mostly succeeded with credentials that were stolen from the enterprise domain, left at a default, or belonged to an account nobody used any more. Treat vendor and integrator accounts as identities with an owner, an expiry and session recording; remove shared accounts on jump hosts; and inventory the machine identities (OPC UA certificates, service accounts on historians, VPN device certificates) that cross the IT and OT boundary. The Colonial Pipeline ransomware attack shows the cost on the IT side: a dormant legacy VPN profile without MFA led to a precautionary pipeline shutdown, even though pipeline controls were not directly manipulated. See the OT and ICS Identity and Access Guide.
Implementation roadmap
- Find what is exposed: run an external attack surface scan for your address space and compare against the OT asset inventory; check cellular gateways and vendor-installed modems, which often sit outside central firewall control.
- Close or broker every exposure: disconnect devices that do not need internet reachability; move the rest behind a VPN or remote access broker with phishing-resistant MFA. Test each change with the site's operations team and keep the old path disabled, not deleted, for a defined rollback window.
- Fix credentials on what remains reachable: change default passwords on controllers, HMIs, gateways and switches; disable dormant and shared accounts.
- Segment and allowlist: build the IT/OT DMZ, then restrict controller programming and management ports to named engineering workstations. Run new firewall rules in log-only mode first and review hits with operations before blocking.
- Control what people bring: introduce media scanning kiosks, a transient device register and checks on vendor software hashes before installation.
- Turn on the detections: deploy the v20 analytics for T0822, T0883 and T0886 first, using the communication matrix as the baseline; tune for maintenance windows rather than suppressing.
Decision guidance
- Remote access broker or site VPN: a broker with per-session approval and recording suits sites with many vendors; a site VPN with MFA and a jump host can be enough for a small number of internal engineers.
- Small sites and utilities: CISA's primary mitigations are the realistic baseline: no internet exposure, no default passwords, MFA on remote access, IT/OT separation and tested manual operation.
- Large or multi-site operators: invest in centralised remote access, passive OT network monitoring at zone boundaries and a single register of third-party identities.
Framework mapping
| Framework | Relevant references |
|---|---|
| NIST SP 800-53 Rev. 5 | AC-17 Remote Access, AC-2 Account Management, IA-2 Identification and Authentication (Organizational Users), IA-5 Authenticator Management, SC-7 Boundary Protection, MP-7 Media Use, SR-3 Supply Chain Controls and Processes, RA-5 Vulnerability Monitoring and Scanning, SI-4 System Monitoring |
| NIST CSF 2.0 | ID.AM-01, PR.AA-01, PR.AA-03, PR.AA-05, PR.IR-01, GV.SC-07, DE.CM-01 |
| NIST SP 800-82 Rev. 3 | OT-specific tailoring of the SP 800-53 controls above, including remote access and network architecture |
| ISA/IEC 62443-3-3 | SR 1.1 Human user identification and authentication, SR 1.5 Authenticator management, SR 1.13 Access via untrusted networks, SR 2.3 Use control for portable and mobile devices, SR 5.1 Network segmentation, SR 5.2 Zone boundary protection |
| CIS Controls v8.1 | Control 1 Inventory and Control of Enterprise Assets, Control 5 Account Management, Control 6 Access Control Management, Control 12 Network Infrastructure Management, Control 15 Service Provider Management |
Common failure patterns
- Forgotten cellular gateways: devices connected by an integrator for remote support that never appear in the firewall rule base or the asset register, which is how many internet accessible PLCs are found.
- Remote programming left on: the AA23-335A Unitronics advisory describes devices reached on the default TCP port 20256 with default or no passwords, then reprogrammed and defaced.
- MFA on the main VPN but not the legacy profile: one old access path without MFA undoes the rest.
- Dual-homed hosts: an HMI or historian with one interface on the corporate network turns any enterprise compromise into OT Initial Access.
- Vendor accounts that never expire: shared, always-on vendor logins with no session recording, so nobody can say who connected or what they changed.
- Trusting installers by source: downloading vendor software from the vendor's website is not proof of integrity; Dragonfly trojanised packages hosted on ICS suppliers' own sites.
Practitioner checklist
- Scan your external address space and cellular ranges for exposed OT devices every month.
- Route all staff and vendor remote access through one brokered path with phishing-resistant MFA and recording.
- Confirm no controller, HMI or gateway uses a default or blank password.
- Disable dormant VPN profiles and vendor accounts, and set an expiry on every new one.
- Restrict controller programming ports to named engineering workstations.
- Remove dual-homed connections between corporate and control networks.
- Scan removable media and transient laptops before they connect to OT.
- Verify vendor software hashes and signatures before installation.
- Deploy the v20 detection analytics for T0822, T0883 and T0886, baselined on the communication matrix.
Standards and references
- MITRE ATT&CK for ICS: Initial Access (TA0108)
- MITRE ATT&CK for ICS: Remote Services (T0886)
- MITRE ATT&CK for ICS: Internet Accessible Device (T0883)
- MITRE ATT&CK for ICS: External Remote Services (T0822)
- CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA: Cybersecurity Advisory AA23-335A on IRGC-affiliated actors exploiting PLCs
- NIST: SP 800-82 Rev. 3 Guide to Operational Technology (OT) Security
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · OT Remote Access Guide · ATT&CK for ICS Persistence Tactic Guide · ATT&CK for ICS Command and Control Tactic Guide · OT Security Guide