Data from Information Repositories (T0811) is an adversary collecting specifications, schematics, network diagrams, manuals and other documents that describe how a control system is built and run. These files often live outside the control network, on engineering file shares, document management systems and corporate databases, so the theft can happen long before the adversary touches OT. MITRE ATT&CK for ICS v20 lists T0811 under Collection (TA0100) for Embedded, Windows and Linux platforms, with control servers and data historians as targeted assets. This guide is for OT security engineers, engineering document owners and SOC analysts: what the technique covers, the campaign ATT&CK describes, the v20 analytics and six mitigations, and how to decide what to protect. It goes deeper on the OT angle than T1213 Data from Information Repositories Defensive Guide, which covers enterprise platforms such as SharePoint and Confluence.
Key takeaways
- Documentation is attack planning material. ATT&CK notes collected information can give the adversary a better understanding of the environment, vendors, processes and procedures.
- The search terms are known. In the 2011 to 2013 campaign ATT&CK describes, actors looked for system manuals, RTU sites, personnel lists, documents containing "SCAD*", credentials and remote dial-up access information.
- Repositories span IT and OT. ATT&CK includes reference databases in the process environment and corporate databases that hold ICS information.
- Six mitigations are mapped, most of them identity. Audit, encryption, file permissions, user account management, privileged account management and user training.
- Bulk access is the detection signal. Detection strategy DET0754 looks for bulk document access or archive creation by accounts outside documented engineering roles.
What T0811 covers
ATT&CK for ICS describes T0811 as targeting and collecting data from information repositories, which can include sensitive data such as specifications, schematics or diagrams of control system layouts, devices and processes. The table lists the repository types worth inventorying; the examples are typical locations, not an ATT&CK list.
| Repository | What it may hold | Usual location |
|---|---|---|
| Engineering file shares and document management | P&IDs, network and wiring diagrams, functional specifications, manuals, vendor contacts | Corporate network or OT DMZ |
| Controller project archives and backups | PLC and DCS programs, HMI projects, configuration exports | Engineering workstations, backup servers |
| Data historians | Years of process values, tag names and descriptions | Control network with DMZ replicas |
| Asset and maintenance systems | Device inventories, firmware versions, site lists, remote access details | Corporate network |
| Field devices themselves | Configuration, program blocks and data records readable over control protocols | Control network |
The last row is why ATT&CK lists an embedded analytic: bulk reading of configuration and program objects from devices is a repository collection too. Theft of the same information as an end goal is mapped separately as Theft of Operational Information (T0882).
What the known cases show
- 2011 to 2013 oil and natural gas campaign: ATT&CK, citing CISA advisory AA21-201A, describes Chinese state-sponsored actors searching document repositories of oil and natural gas organisations for system manuals, remote terminal unit (RTU) sites, personnel lists, documents including the string SCAD*, user credentials and remote dial-up access information. The combination matters: documents tell the adversary where to go, and the credentials and dial-up details tell them how.
- Duqu (S0038): ATT&CK records Duqu downloading additional modules for collection from information repositories, including an Infostealer 2 module that can access data from Windows shares.
Neither case had to touch a controller to gather this information. Repository protection is therefore an IT and identity task as much as an OT one.
Detection: ATT&CK v20 analytics
MITRE's v20 detection strategy for T0811 is DET0754, with three analytics. All use ATT&CK's OT operational fidelity gate: do not alert on novelty or volume alone; alert when the source role is not authorised and scope or rate deviates from the baseline; suppress normal polling, backup, asset inventory and approved engineering work.
| Analytic | Platform | What it looks for | Data source |
|---|---|---|---|
| AN1886 | Windows | Access to ICS documentation repositories by an account not tied to documented engineering roles, followed by bulk file access or archive creation; bulk historian SQL queries from accounts outside approved clients | File server audit logs; historian logs; Windows Security Event ID 4624 and 4625 for logons by accounts outside the authorised engineer list |
| AN2114 | Linux | Sequential reads of ICS documentation or configuration files, such as P&ID stores and configuration archives, by a user ID outside the engineering or backup account set | Linux audit SYSCALL and PATH records |
| AN2247 | Embedded | Protocol sessions bulk reading configuration, program blocks or data records from field devices, from a source with no prior configuration read history | Network content inspection |
The tunable inputs are AuthorizedEngineerAccounts, ApprovedHistorianClients, BulkDocumentAccessThreshold, BulkQueryThreshold and InformationRepositoryTimeWindow. Windows file share auditing (object access auditing on the share) is the usual source for the file server logs; scope it to the folders that hold ICS documentation to keep volume manageable.
Prevention: ATT&CK mitigations in practice
| Mitigation | ATT&CK guidance for T0811 | Practical step |
|---|---|---|
| M0947 Audit | Periodically review accounts and privileges for critical and sensitive repositories | Quarterly access review of engineering shares and historian roles, signed off by the document owner |
| M0941 Encrypt Sensitive Information | Encrypt information sensitive to the operation and architecture of the process environment, restricting it to those with a need to know | Encrypt project archives and diagram sets at rest and in transit to integrators |
| M0922 Restrict File and Directory Permissions | Use proper permissions to limit adversary interaction with and collection from databases | Remove broad groups such as all domain users from engineering folders |
| M0918 User Account Management | Assign permissions by role through IAM, with individual accounts for role enforcement and non-repudiation | Named accounts for every engineer and integrator; no shared logins |
| M0926 Privileged Account Management | Minimise permissions and access for service accounts | Scope backup, indexing and historian service accounts to the data they need |
| M0917 User Training | Publish policies defining acceptable information to store in repositories | Rules on where diagrams, credentials and remote access details may be kept |
One point from the campaign above deserves its own control: credentials and remote access details should never sit in documents. Store them in a vault or privileged access tool, and search engineering repositories for them periodically. See the Engineering Workstation Security Guide for protecting project files at source.
Where identity fits
Four of ATT&CK's six mitigations for T0811 are about accounts and permissions. The identities that matter most are often non-human: backup service accounts that can read every project archive, search and indexing services that crawl engineering shares, historian replication accounts and integrator accounts that outlive the project. ATT&CK's Linux analytic explicitly expects an "engineering or backup account set", so each of these needs a documented owner and scope. Remove integrator access when work ends. See the OT and ICS Identity and Access Guide and the OT Third-Party and Integrator Access Guide.
How to implement
- Inventory repositories. Find where ICS documentation, project archives and historian data live, including copies in email, collaboration sites and integrator portals.
- Classify. Agree with engineering which document sets are sensitive, such as network diagrams, safety system details and remote access information.
- Review and cut access. Run an access review, remove broad groups and shared accounts, and scope service accounts. Communicate changes to engineers first, since lost access to drawings during an outage is a real operational risk.
- Turn on auditing for the sensitive folders and historian queries, and forward events to the SOC.
- Deploy DET0754-style alerts in alert-only mode, tuning thresholds against backup and indexing jobs.
- Remove secrets from documents and move them to a vault.
- Keep a rollback: export the previous permission sets before changing them, so access can be restored quickly if an engineer is blocked during an incident.
Decision guidance
- Small organisations: one well-permissioned engineering share with auditing, no shared accounts and no credentials in documents covers most of the risk.
- Large or multi-site organisations: a document management system with role-based access, classification labels and SOC monitoring is worth the effort, along with integrator portals that expire access.
- Corporate versus OT hosting: keeping documentation on the corporate network is convenient for engineers but exposes it to any IT compromise; hosting it in the OT DMZ reduces exposure but needs its own access model. Decide per document set based on sensitivity.
Detection and measurement
- Repository inventory coverage: percentage of known ICS documentation locations with a named owner.
- Access review completion: percentage of sensitive repositories reviewed in the last quarter.
- Broad access: count of sensitive folders readable by large groups or shared accounts.
- Secrets in documents: count of credentials or remote access details found in repositories, trending to zero.
- Bulk access alerts: count of DET0754-style alerts, with time to triage and outcome.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| MITRE ATT&CK for ICS v20 | T0811 (TA0100 Collection); M0947, M0941, M0922, M0918, M0926, M0917; DET0754; related T0882 | Technique, mitigations, analytics and impact technique |
| MITRE ATT&CK Enterprise v20 | T1213 Data from Information Repositories | IT side of the same behaviour |
| MITRE D3FEND | D3-UBA User Behavior Analysis | Spotting bulk access by unusual accounts |
| NIST SP 800-53 Rev. 5 | AC-2 Account Management; AC-3 Access Enforcement; AC-6 Least Privilege; SC-28 Protection of Information at Rest; AU-2 Event Logging; AU-6 Audit Record Review, Analysis, and Reporting | Accounts, permissions, encryption and auditing |
| NIST CSF 2.0 | PR.AA-05; PR.DS-01; DE.CM-09 | Least privilege, data at rest protection and monitoring |
Common failure patterns
- Engineering shares open to all staff: any compromised corporate account can read network diagrams and manuals.
- Credentials and dial-up details in documents: exactly what the 2011 to 2013 actors searched for.
- Over-privileged service accounts: backup and indexing accounts can read everything and are rarely monitored.
- Integrator access never removed: project portals and accounts stay live years after commissioning.
- No auditing on document stores: bulk copying leaves no trace to investigate.
Practitioner checklist
- Inventory every location holding ICS documentation, project archives and historian data.
- Classify sensitive document sets with engineering.
- Remove broad groups and shared accounts; give each engineer and integrator a named account.
- Scope backup, indexing and historian service accounts and record their owners.
- Encrypt project archives and diagram sets at rest and in transfer.
- Move credentials and remote access details out of documents into a vault.
- Audit sensitive folders and historian queries and alert on bulk access.
- Review access quarterly and remove integrator access when work ends.
Standards and references
- MITRE ATT&CK for ICS: Data from Information Repositories (T0811)
- MITRE ATT&CK: Detection of Data from Information Repositories (DET0754)
- MITRE ATT&CK: Duqu (S0038)
- MITRE ATT&CK Enterprise: Data from Information Repositories (T1213)
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · T1213 Data from Information Repositories Defensive Guide · Engineering Workstation Security Guide · OT and ICS Identity and Access Guide · OT Backup, Recovery and Golden Image Guide · T0802 Automated Collection · T0845 Program Upload