T0802 Automated Collection: Detecting Scripted Harvesting of OT Data

Automated Collection (T0802) is an adversary using tools or scripts to sweep an industrial network for information, often through the same native protocols, such as OPC, that control systems use every day. It turns a foothold on one host into a map of every attached server and device, and the output feeds later discovery and impact steps. MITRE ATT&CK for ICS v20 lists T0802 under Collection (TA0100) for Embedded, Windows and Linux platforms. This guide is for OT security engineers, control engineers and OT SOC analysts: what the technique covers, what Backdoor.Oldrea, Industroyer and Industroyer2 show about it, ATT&CK's v20 analytics, and the two mitigations ATT&CK maps to it. It goes deeper than the Enterprise view in MITRE ATT&CK T1119 Automated Collection, which covers file and cloud collection on IT systems.

Key takeaways

• Native protocols do the work. ATT&CK's description gives OPC as an example: access to one interface can enumerate and collect from other attached, communicating servers and devices.
• Sweeps look different from polling. Detection strategy DET0734 looks for sequential reads across full address ranges and many devices in a short window, from sources not on the approved list.
• Bulk historian exports count too. ATT&CK's embedded analytic includes historian queries above a bulk threshold from accounts outside the approved historian clients.
• Two mitigations are mapped. M0807 Network Allowlists and M0930 Network Segmentation, both aimed at stopping unauthorised systems reaching control servers and field devices.
• Staging files are a host signal. On Windows, ATT&CK's analytic uses Sysmon Event ID 11 for an unrecognised process creating an output file after bulk ICS data access.

What T0802 covers and how it differs

ATT&CK for ICS describes T0802 as automating collection of industrial environment information using tools or scripts, which may leverage native control protocols and tools in the environment. The distinguishing feature is scale and automation, not the data source.

The procedure examples and what they teach

• Backdoor.Oldrea (S0093): ATT&CK records that, using OPC, a component of Oldrea gathers details about connected devices and sends them back to its command and control server; ATT&CK attributes Oldrea's use to Dragonfly (G0035). The lesson is that OPC servers on Windows hosts are a single place from which an implant can learn about many devices, so OPC client identities and connections need to be controlled and logged. See the OPC Classic and DCOM Hardening Guide and the Berserk Bear Threat Actor Profile Guide.
• Industroyer (S0604): automatically collects protocol object data to learn about control devices in the environment.
• Industroyer2 (S1072): uses a hardcoded list of remote station IP addresses to iteratively initiate communications and collect information across multiple IEC 60870-5-104 priority levels. ESET reports the sample it analysed contained eight device IP addresses and could talk to several devices at once, and assesses with high confidence that it was Sandworm's work, scheduled for 8 April 2022. See the IEC 60870-5-104 Telecontrol Security Guide.

In both Industroyer cases collection was a step towards switching operations. A sweep from an unexpected host on a telecontrol network should be treated as possible preparation for impact, not routine reconnaissance.

Detection: ATT&CK v20 analytics

MITRE's v20 detection strategy for T0802 is DET0734, with three analytics. All use ATT&CK's OT operational fidelity gate: alert when the source role is not authorised for discovery or polling and the target scope, address range, protocol or rate deviates from the baseline; suppress normal SCADA, HMI and historian polling, commissioning, asset inventory, backup, diagnostics and approved engineering work.

The tunable inputs ATT&CK names are ApprovedHistorianClients, ApprovedSCADAServers, AutoCollectionTimeWindow (the window in which reads across devices count as one collection event) and BulkQueryThreshold (the record count above which a historian query is a bulk export). Setting the time window and threshold from measured normal activity is what separates a sweep from an asset inventory job.

Prevention: ATT&CK mitigations in practice

• M0807 Network Allowlists: ATT&CK advises restricting unnecessary connections to network devices, such as communications servers and serial to Ethernet converters, and services, especially where devices limit the number of simultaneous sessions. Allowlisting at the device or gateway means a new host cannot open a session at all. See the Industrial Switch and Serial Gateway Hardening Guide.
• M0930 Network Segmentation: prevent unauthorised systems from accessing control servers or field devices containing industrial information, especially services for automation protocols such as DNP3 and OPC. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.

Beyond ATT&CK's mappings, NHI Mgmt Group recommends three supporting controls: application allowlisting on SCADA, historian and engineering hosts so unapproved interpreters and tools cannot run; role-based access on historians so only named reporting accounts can run bulk exports; and a DMZ historian replica for business consumers, so bulk queries never touch the control zone.

Where identity fits

Automated collection usually runs under someone else's identity: a historian service account, a shared engineering login, an OPC client that was already trusted. ATT&CK's Linux analytic keys on the user ID running the interpreter, and its embedded analytic on historian accounts outside the approved list. Give scheduled automation its own documented service accounts, separate from interactive engineers, restrict those accounts to the data they need, and alert when an interactive account runs bulk collection. See the OT and ICS Identity and Access Guide.

How to implement

1. List legitimate automation. Record every scheduled script, reporting job, asset inventory tool and historian export, with its host, account, schedule and targets.
2. Measure normal sweeps. Capture what an approved asset inventory scan and a normal historian export look like, to set the time window and bulk threshold.
3. Restrict sessions. Apply allowlists at conduits and on communications gateways, logging would-be denies before enforcing.
4. Turn on host telemetry: Sysmon FileCreate and process creation on Windows OT hosts and audit rules for interpreter execution on Linux, forwarded to the OT SOC.
5. Deploy DET0734-style alerts in alert-only mode through at least one maintenance cycle, suppressing jobs on the automation list.
6. Keep a rollback: record allowlist and gateway changes with previous settings, since a missed legitimate client can cost operators their view.

Decision guidance

• Small sites: segmentation and removing interpreters and unneeded tools from OT hosts give most of the protection; review historian export accounts by hand.
• Large or telecontrol-heavy sites: protocol-aware monitoring at control centres and substations, gateway allowlists and an OT SOC are needed, because one control centre host can reach many remote stations.
• Asset inventory tools: active scanners look like T0802 by design. Run them from a fixed, documented host on a schedule, so their traffic can be suppressed by source and time rather than by blanket exceptions.

Responding to a suspected sweep

Confirm with operations that the process is stable. Preserve network captures, historian logs, the staging file and the source host's process and logon history before cleaning anything. Block the source at the conduit or gateway rather than isolating supervisory systems. Identify what was collected and where it went, since collected data may already have left the network. Then look for follow-on activity against the devices that were swept. See the OT Incident Response Guide.

Detection and measurement

• Automation inventory coverage: percentage of scheduled scripts and exports with a named owner, account and target list.
• Gateway allowlist coverage: percentage of communications servers and serial gateways restricting sessions to approved clients.
• Host telemetry coverage: percentage of Windows and Linux OT hosts forwarding process and file creation events.
• Interpreter presence: count of OT hosts with scripting interpreters not required for their role.
• Unexplained sweeps: count of sequential read or bulk export events not matched to the automation list, each investigated.

Framework mapping

Common failure patterns

• Flat control networks: any compromised host can sweep every device, which is what M0930 exists to prevent.
• Blanket exceptions for scanners: suppressing all sequential reads hides an attacker's sweep along with the inventory tool's.
• Interpreters left on OT hosts: general purpose scripting tools on SCADA servers make automation easy for an intruder.
• Bulk historian exports open to many accounts: years of process history leave in one query.
• No host telemetry: network monitoring sees reads but not the staging file or the account behind them.

Practitioner checklist

• Inventory scheduled scripts, inventory scans and historian exports with owners and accounts.
• Segment control servers and field devices so only approved hosts can reach automation protocols.
• Restrict sessions on communications servers and serial gateways to approved clients.
• Remove unneeded interpreters and tools from OT hosts and allowlist applications.
• Limit bulk historian exports to named accounts; serve business users from a DMZ replica.
• Forward Sysmon and Linux audit events from OT hosts to the OT SOC.
• Deploy DET0734-style alerts with measured time windows and thresholds.

Standards and references

• MITRE ATT&CK for ICS: Automated Collection (T0802)
• MITRE ATT&CK: Detection of Automated Collection (DET0734)
• MITRE ATT&CK for ICS: Network Allowlists (M0807)
• MITRE ATT&CK for ICS: Network Segmentation (M0930)
• MITRE ATT&CK: Backdoor.Oldrea (S0093)
• ESET: Industroyer2: Industroyer reloaded
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security

Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · MITRE ATT&CK T1119 Automated Collection · OT Network Security Monitoring Guide · OPC UA Security Guide · OT Asset Visibility Guide · T0801 Monitor Process State · T0861 Point and Tag Identification