ATT&CK for ICS T0817 Drive-by Compromise in OT

Drive-by Compromise (T0817) is how an adversary reaches an industrial network through a web browser: an engineer, operator or supplier visits a site they trust, and the visit itself delivers malware or leaks credentials. In ATT&CK for ICS the technique sits under Initial Access and is closely tied to watering hole attacks, where the attacker compromises websites that a specific community, such as ICS trade publications or vendor support portals, visits as part of normal work. This guide covers what the ICS version adds to the enterprise technique, the procedure examples ATT&CK records, how browsing reaches OT in practice, the detection analytics ATT&CK attaches to T0817, prevention that fits engineering workflows, and safe response. It is written for OT security engineers, control system owners and SOC analysts. For the matrix as a whole see the MITRE ATT&CK for ICS Guide; for the tactic see the ATT&CK for ICS Initial Access Tactic Guide.

Key takeaways

The target is the community, not the company. ATT&CK describes T0817 as aimed at groups such as trusted third-party suppliers or industry-specific audiences, so a well-defended operator can be reached through the sites its engineers read.
Credential theft can be the whole payload. In the Dragonfly activity CISA describes, modified pages made visiting Windows browsers request a resource over SMB, which sends the visitor's credential hash to the attacker. No malware needs to run.
The browser on an OT-connected host is the real exposure. Engineering workstations and jump hosts that can browse the internet turn a website compromise into an OT foothold.
ATT&CK's analytic is a browser spawning something it should not. A browser child process right after visiting a vendor or download site, on an ICS workstation, is the signal; the OT fidelity gate keeps alerts tied to OT-relevant follow-on activity.
Prevention is mostly architecture. Remove direct internet browsing from OT hosts, block outbound SMB and WebDAV at the boundary, and give engineers a safe route to vendor downloads.

What T0817 covers in ICS

ATT&CK for ICS v20 defines Drive-by Compromise as gaining access to a system when a user visits a website during a regular browsing session, with the browser targeted and exploited simply by visiting the compromised site. The technique applies to Windows and Linux platforms in the ICS matrix. ATT&CK highlights the targeted form, the strategic web compromise or watering hole, which relies on a common interest among visitors.

What makes the ICS entry distinct is its context. ATT&CK cites the US-CERT technical alert on Russian government activity against critical infrastructure (TA18-074A), in which the adversary used watering holes on process control, ICS and critical infrastructure trade publications and informational websites to reach intended targets. The enterprise equivalent is T1189 Drive-by Compromise; see the Drive-by Downloads Guide and the Watering Hole Attacks Guide for the general browser controls. This page covers what changes when the visitor works on industrial systems.

Technique	How the user is reached	OT example	First control
T0817 Drive-by Compromise	Visiting a compromised or malicious website	An engineer reading a compromised ICS trade publication site	No internet browsing from OT hosts; boundary filtering
T0865 Spearphishing Attachment	A targeted email with a malicious file	A fake vendor document sent to plant staff	Email filtering and attachment controls
T0862 Supply Chain Compromise	Trojanised software or firmware from a trusted supplier	A legitimate vendor download replaced with a modified installer	Verify hashes and signatures before installing
T0863 User Execution	A user runs something the attacker delivered	Running a downloaded utility on an engineering workstation	Application allowlisting on OT hosts

These often chain. A drive-by on a vendor site can deliver a trojanised download, which the user then runs. See the MITRE ATT&CK for ICS T0862 Supply Chain Compromise, T0865 Spearphishing Attachment and T0863 User Execution guides.

Procedure examples ATT&CK records

ATT&CK v20 lists five procedure examples for T0817. Each is stated here as ATT&CK words it.

Actor or software	What ATT&CK records	Lesson for defenders
Dragonfly (G0035)	Watering hole attacks on energy sector websites, injecting a redirect iframe to deliver Backdoor.Oldrea (S0093) or Trojan.Karagany (S0094)	Sector websites are part of your attack surface even though you do not run them
ALLANITE (G1000)	Watering hole attacks to gain access into electric utilities	Utilities are a named target community
TEMP.Veles (G0088)	Watering hole websites used to target industrial employees	The group ATT&CK links to TRITON uses the browser as one way in
OilRig (G0049)	Watering hole attacks to collect credentials that could be used to gain access into ICS networks	Harvested credentials feed T0859 Valid Accounts later
Bad Rabbit (S0606)	Ransomware spread through drive-by attacks on compromised legitimate websites, with a dropper downloaded while the target visits	Non-targeted drive-by malware still reaches OT hosts that browse

ATT&CK groups Dragonfly with the aliases Berserk Bear and Energetic Bear, among others; see the Berserk Bear Threat Actor Profile Guide and the OilRig Threat Actor Profile Guide. ATT&CK's detection analytic for T0817 also notes the Havex precedent, where adversaries compromised legitimate ICS vendor websites to serve trojanised software downloads.

What the TA18-074A alert showed

The CISA alert TA18-074A (first published 15 March 2018) is the most detailed public account of the watering hole technique against critical infrastructure. CISA described two categories of victim: staging targets, such as trusted third-party suppliers with weaker networks, used as pivot points and malware repositories; and intended targets in energy, nuclear, commercial facilities, water, aviation and critical manufacturing. Points that matter for defenders:

About half of the compromised sites were trade publications and informational websites focused on process control, ICS or critical infrastructure.
The attackers edited legitimate site content using legitimate credentials, altering JavaScript and PHP files. In one case a line was added to a site's header.php; in another a JavaScript library was altered to load an image from a remote server.
The injected code made the browser request a resource over SMB from an attacker-controlled address, which causes Windows to send the user's credential hash. That is credential harvesting without any exploit.
The goal was OT. CISA reported the actors later accessed workstations and servers holding data from generation control systems, copied VNC profiles with configuration details for reaching ICS, and investigators reconstructed fragments of an HMI screenshot.

How browsing reaches OT

A drive-by only matters to OT if the browsing host, or the credentials it leaks, connect to the control network. Four paths account for most of the risk.

Path	Why it happens	What the attacker gains	Fix
Engineering workstation with internet access	Engineers download manuals, firmware and patches directly	Code execution on the host that programs controllers	Remove direct browsing; use a staging host for downloads. See the Engineering Workstation Security Guide
HMI or SCADA server used for browsing	Convenience in control rooms, especially on night shifts	A foothold on a supervisory host	Block outbound web from HMI subnets; application allowlisting. See the HMI and SCADA Server Hardening Guide
Corporate laptop with OT remote access	The same user browses at the desk and connects to OT through VPN	Harvested credentials or a host that later joins an OT session	Brokered access from a clean jump host, phishing-resistant MFA
Supplier and integrator staff	Staging targets with weaker controls and trusted links into your sites	A trusted foothold one step away	Contract terms, brokered vendor access. See the OT Third-Party and Integrator Access Guide

The SMB hash-leak pattern makes the third path important. A credential captured from a corporate laptop is worth little if OT access requires a separate account, a broker and MFA; it is worth a great deal if the same domain password opens the OT VPN.

Detection: ATT&CK's analytics for T0817

ATT&CK v20 attaches a detection strategy, Detection of Drive-by Compromise, with two analytics. Both carry the OT operational fidelity gate: alert only when the account, device or session breaks the approved identity, source host, jump path or zone policy and is corroborated by access to a protected OT asset, execution, a configuration change or another security-relevant follow-on event. Approved shift activity, vendor support, break-glass use, commissioning and documented remote-access windows are suppressed.

Platform	What it looks for	Practical data source
Windows	A browser process on an ICS workstation spawning an unexpected child process immediately after navigating to an external website, particularly a vendor support or software download site	Process creation telemetry with parent process (for example Sysmon Event ID 1 or Windows Security Event ID 4688 with command line), plus proxy or DNS logs for the visited site
Linux	A browser process on an ICS Linux workstation spawning child processes with arguments inconsistent with normal browsing, or writing binaries to /tmp or user home directories	auditd execve records, file integrity monitoring on writable paths

Network signals that complement the analytics

Outbound SMB or WebDAV from any internal host to the internet: CISA's TA18-074A mitigation was to block SMB (TCP 139 and 445, UDP 137) and WebDAV at the boundary. An attempt that hits the block is still worth an alert, because it means a page tried to harvest credentials.
Any web traffic from OT zones to the internet: if your design says OT hosts do not browse, every HTTP or HTTPS flow from Level 2 and below to an external address is a policy breach. See the OT Network Security Monitoring Guide.
New executables on engineering hosts after a download: correlate proxy download events with file creation on the same host, and check the hash against the vendor's published value.
Authentication from a new source shortly after a suspected visit: if a user's hash may have leaked, watch for that account authenticating from unfamiliar hosts or to the OT VPN.

The fidelity gate matters in OT. Engineering hosts legitimately run vendor installers, and an analytic that fires on every installer gets disabled. Tie alerts to hosts in OT inventory, and to a follow-on action such as a new connection into the control network.

Prevention that fits engineering work

ATT&CK lists four mitigations for T0817: M0948 Application Isolation and Sandboxing, M0950 Exploit Protection, M0921 Restrict Web-Based Content and M0951 Update Software. In OT the strongest control is architectural, which ATT&CK's segmentation guidance and the joint agency OT mitigations support.

Stop direct internet browsing from OT hosts: CISA, the FBI, EPA and DOE list segmenting IT and OT networks, with a DMZ between them, among their primary OT mitigations. Enforce it with outbound deny rules from OT zones rather than relying on users. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Give engineers a safe download route: a staging host in the IT network or OT DMZ fetches vendor files, checks hashes and signatures, scans them, and transfers them inward through a controlled file transfer. Without this, engineers will find their own route.
Block outbound SMB and WebDAV at the internet boundary: this removes the hash-leak path CISA described, for every host, at little operational cost.
Restrict web content (M0921) and isolate the browser (M0948): ATT&CK suggests restricting browsers to limit malicious adverts and JavaScript, and using built-in browser sandboxes or application isolation. Where a corporate user with OT access must browse, remote browser isolation keeps active content off the endpoint. See the Remote Browser Isolation Guide and the Secure Web Gateway and Web Filtering Guide.
Exploit protection and updates (M0950, M0951): ATT&CK says to keep browsers and plugins updated and use modern browsers with security features enabled. On OT hosts that cannot be patched quickly, removing the browser or blocking egress is the safer answer.
Separate OT credentials: distinct accounts for OT access, not reusing domain passwords, with phishing-resistant MFA on remote access, so a leaked corporate hash does not open the control network. See the OT and ICS Identity and Access Guide.

Choosing between options

Situation	Preferred approach	Trade-off
Engineering workstation needs vendor files	Staging host with hash check and controlled transfer	Slower downloads; needs an owner
Control room staff want web access	Separate IT terminal or isolated browser, not the HMI	Extra hardware or licences
Corporate users with OT remote access	Brokered access from a dedicated jump host, separate OT account	More steps for engineers
Small site with one shared PC	Remove the browser from the control PC and use a phone or office PC for research	Discipline is the control, so it must be checked

Large estates can add browser isolation and centralised analytics. Small sites get most of the benefit from egress blocking and keeping browsers off control hosts.

Where identity fits

The OilRig procedure example and the TA18-074A SMB technique show that a drive-by often aims at credentials rather than code execution. Those credentials matter only if they work on OT. Three identity controls cut the chain: separate OT accounts that do not share passwords with the corporate domain, no shared engineering accounts (each person authenticates as themselves so misuse is attributable), and machine credentials such as stored VNC or remote desktop profiles kept off internet-facing hosts. CISA reported the actors copying VNC profiles with configuration details for reaching ICS, which is a reminder that saved connection files are credentials. See the NHIs in OT guide.

Safety-aware response

Scope the host first: is the affected browser on an OT host, or a corporate host with OT access? The answer decides whether operations must be involved from the start.
Agree containment with operations: isolating an engineering workstation is usually safe; isolating an HMI may remove operator view. Confirm manual operation or a backup HMI is available before pulling it. The joint agencies list practising manual operation among the primary OT mitigations.
Reset exposed credentials: if an SMB hash leak is possible, reset the user's password and any OT accounts that share it, and review recent logons for those accounts.
Look for the next step: review authentication to the OT VPN and jump hosts, new remote sessions, and project file access since the visit.
Preserve evidence: browser history, proxy and DNS logs, the downloaded files and process telemetry. See the OT Incident Response Guide.
Rebuild, do not clean: restore engineering hosts from a known-good image and verify project files against backups. See the OT Backup, Recovery and Golden Image Guide.

Metrics that show it is working

OT hosts with internet egress: count of Level 2 and below hosts that can reach the internet on web ports. Target zero.
Outbound SMB and WebDAV attempts: blocked attempts per month, each reviewed. A rising count means users are reaching sites that try to harvest hashes.
Vendor downloads through the staging route: share of software brought into OT with a recorded hash check. Target 100%.
Shared credentials between IT and OT: OT accounts whose password or identity is shared with the corporate domain. Target zero.
Analytic precision: share of T0817 alerts closed as approved installers; a high share means the baseline or gate needs work.

Framework mapping

Control area	NIST SP 800-53 Rev 5	NIST CSF 2.0	ATT&CK for ICS mitigation
No internet browsing from OT, egress filtering	SC-7 Boundary Protection	PR.IR-01	M0921 Restrict Web-Based Content
Browser isolation and sandboxing	SC-44 Detonation Chambers; SC-18 Mobile Code	PR.PS-01	M0948 Application Isolation and Sandboxing
Exploit protection and malware defence	SI-3 Malicious Code Protection	PR.PS-02	M0950 Exploit Protection
Browser updates	SI-2 Flaw Remediation	PR.PS-02	M0951 Update Software
Separate OT credentials	AC-2 Account Management; IA-2 Identification and Authentication	PR.AA-01; PR.AA-03	See T0859 mitigations
Detection	SI-4 System Monitoring	DE.CM-01; DE.CM-09	ATT&CK detection strategy for T0817
Awareness for engineers	AT-2 Literacy Training and Awareness	PR.AT-01	Not applicable

NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security (final, 28 September 2023), is the OT tailoring reference; NIST notes an initial public draft of Revision 4 is open for comment until 30 November 2026. See the NIST SP 800-82 OT Security Guide and the IEC 62443 Guide.

Common failure patterns

Engineering workstations that browse: the host trusted to program controllers is also the one reading vendor forums. One compromised site reaches the control network.
Allowing outbound SMB: the TA18-074A technique worked because browsers could send authentication to the internet. A boundary block removes it for every host at once.
One password for IT and OT: a hash captured from a corporate laptop becomes an OT VPN login.
Trusting a site because it is industry-specific: CISA found that about half of the compromised sites were ICS and critical infrastructure publications, chosen because the audience trusts them.
No safe download path: when the only way to get a firmware file is to browse from the engineering host, policy loses to deadlines.

Practitioner checklist

Deny internet web access from all OT zones by firewall rule, and alert on any attempt.
Block outbound SMB (TCP 139 and 445, UDP 137) and WebDAV at the internet boundary.
Remove browsers from HMIs and SCADA servers where operations allow, or restrict them to internal addresses.
Provide a staging host for vendor downloads with hash and signature checks and a controlled transfer inward.
Use separate OT accounts with phishing-resistant MFA on remote access, never the corporate domain password.
Deploy the ATT&CK T0817 analytics on ICS workstations with process creation and parent process logging.
Keep saved remote access profiles and connection files off internet-facing hosts.
Include watering hole scenarios in OT tabletop exercises with suppliers and integrators.

MITRE ATT&CK for ICS T0817 Drive-by Compromise: Detecting Watering Holes Aimed at OT Staff