Network Sniffing (T0842) is an adversary capturing traffic on an industrial network to learn how the process is controlled and to collect credentials that cross the wire in clear text. Many industrial protocols were designed without encryption or authentication, so a capture from the right switch port can show every read, write and login between HMIs, servers and controllers. MITRE ATT&CK for ICS lists T0842 under Discovery for Embedded, Windows, Linux and Network Devices platforms. The host-side defence mirrors Enterprise T1040, so this page focuses on what is different in OT, the procedure examples ATT&CK records, the v20 detection analytics and the ICS mitigations. For the Enterprise detail see the MITRE ATT&CK T1040 Network Sniffing guide, and for the wider matrix the MITRE ATT&CK for ICS Guide.
Key takeaways
- Clear-text protocols make sniffing productive. ATT&CK notes that credentials sent over unencrypted protocols such as Telnet can be captured, and many OT protocols carry commands and values unprotected.
- Attackers have built OT-aware sniffers. ATT&CK records a VPNFilter sniffer module that monitors ICS traffic and INCONTROLLER deploying Tcpdump to collect PCAP files.
- Capture leaves traces on hosts and switches. The v20 analytics look for capture drivers and tools on OT hosts, raw sockets on Linux, and SPAN or port mirroring changes on switches.
- Five ICS mitigations apply. They include encryption, segmentation, static ARP entries, privileged account management and multi-factor authentication.
- Your own monitoring is a sniffer too. Passive OT monitoring sensors and SPAN sessions need the same protection as the traffic they see.
What T0842 covers and what differs in OT
ATT&CK for ICS defines network sniffing as using a network interface on a computer system to monitor or capture information regardless of whether it is the specified destination. Information ranges from general communications between machines to login information sent over unencrypted protocols, and ATT&CK notes that ARP and DNS poisoning can redirect traffic to an adversary to capture credentials.
- The traffic is the process. On a control network, captured traffic shows which tags are polled, which values are written and which hosts issue commands. That knowledge supports later Collection and Impair Process Control techniques.
- Legitimate sniffing is common. OT asset visibility and network security monitoring rely on passive capture from SPAN ports and TAPs, which is preferred in OT because it does not interact with fragile devices. Defenders must tell their own capture apart from an adversary's.
- Encryption is often not an option today. Legacy controllers and protocols may not support it, so segmentation and access control on capture points carry more weight than in IT.
Procedure examples in ATT&CK
| Software | What ATT&CK records | Lesson for defenders |
|---|---|---|
| VPNFilter (S1010) | A packet sniffer module, specific to one small office router model, that monitors ICS traffic and logs basic authentication from packets not on port 502, which may have allowed credential harvesting | Network edge devices that sit in front of OT can become capture points; manage and monitor them as OT assets |
| INCONTROLLER (S1045) | Can deploy Tcpdump to sniff network traffic and collect PCAP files | Unapproved capture tools on Linux-based devices and hosts are a high-value alert |
| Stuxnet (S0603) | Replaced the standard DP_RECV function block used by network coprocessors to receive Profibus frames, so its own block post-processed each packet | Sniffing can happen inside a controller's logic, which only program integrity checking will reveal |
CISA advisory AA22-103A (April 2022, updated May 2022) on the tools later named INCONTROLLER lists Network Sniffing (T0842) among the techniques of its Omron component, which also supports packet captures. Its recommended mitigations include isolating ICS networks, limiting ICS network connections to allowed management and engineering workstations, and continuous OT monitoring.
Detection: ATT&CK v20 analytics
MITRE's v20 detection strategy for T0842 (DET0800) has four analytics, all with ATT&CK's OT operational fidelity gate: suppress approved engineering, diagnostics and monitoring activity, and alert when the source role is not authorised.
| Platform | What the analytic looks for | Data needed |
|---|---|---|
| Windows | A packet capture driver (Npcap or WinPcap) loaded, or a capture utility run, by a process or account not associated with documented network analysis | Sysmon Event ID 6 driver loads and Event ID 1 process creation |
| Linux | Raw socket creation (SOCK_RAW) or tcpdump or tshark execution by a UID that does not normally capture packets | Linux audit rules on socket and execve |
| Embedded | A new device placing its interface in promiscuous mode, or unauthorised SPAN session requests on managed switches | Switch syslog; network monitoring |
| Network devices | SPAN or port mirroring configured from a source outside the approved network management subnet | Switch syslog and configuration change logs |
The tunable inputs are an approved network analysts list and an authorised capture software list. Include your OT monitoring platform's sensors and their service accounts. See the OT Network Security Monitoring Guide.
Prevention: ATT&CK mitigations in practice
| Mitigation | ATT&CK guidance for T0842 | Practical application |
|---|---|---|
| M0808 Encrypt Network Traffic | Encrypt wired and wireless traffic when feasible, and protect credentials in web traffic with TLS | Use secure variants of protocols where controllers and software support them; encrypt remote access and engineering sessions |
| M0930 Network Segmentation | Segment networks to reduce access to critical communications | Keep control traffic inside its zone so a foothold elsewhere cannot capture it |
| M0814 Static Network Configuration | Statically defined ARP entries can prevent manipulation and sniffing of switched traffic | Static ARP on critical HMI and controller pairs where operations can maintain it |
| M0926 Privileged Account Management | Restrict root or administrator access so users cannot run capture tools | No local administrator for operators; capture tools only on approved analyst hosts |
| M0932 Multi-factor Authentication | Use MFA wherever possible | A captured password alone should not grant remote access |
ATT&CK lists these five mitigations for T0842. Filtering and allowlisting at conduits are also worth applying (our recommendation). On switches, also disable unused ports and restrict who can configure SPAN. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Where identity fits
Sniffing is how clear-text OT credentials leak: shared engineering passwords, default device logins and integrator accounts used over unencrypted sessions. Treat any credential seen in clear text as exposed, rotate it, and move remote and engineering access to authenticated, encrypted paths with MFA. Protect the service accounts and keys of monitoring sensors, since they hold a full view of control traffic. See the OT and ICS Identity and Access Guide.
How to implement
- Inventory capture points: every SPAN session, TAP and sensor, with an owner and purpose.
- Find clear-text credentials: use your own passive monitoring to identify protocols carrying logins in clear text, then plan rotation and migration.
- Turn on telemetry: capture driver and process logging on Windows OT hosts, audit rules on Linux, and switch configuration logging to the OT SOC.
- Deploy the analytics in alert-only mode with the approved analyst and software lists, then promote once tuned.
- Apply mitigations in test first: static ARP and protocol changes on a test cell or during a maintenance window, with the previous configuration recorded for rollback.
Decision guidance
- Protocols that support encryption: enable it after vendor testing; it removes most of the value of a capture.
- Legacy protocols: rely on segmentation, locked switch configuration and detection, and record the risk for replacement planning.
- Small sites: managed switches with logging, no local administrator for operators and MFA on remote access cover most of the risk.
- Large sites: add port mirroring change alerts, sensor hardening and a capture point register. See the OT Security Operations Centre Guide.
Responding to suspected sniffing
Identify the capture point: host, switch port or mirror session. Preserve the host's process and driver load history and the switch configuration before changing them. Remove unauthorised mirror sessions and capture tools in agreement with operations. Assume every clear-text credential that crossed the captured segment is compromised and rotate them, starting with engineering and remote access accounts. Then look for follow-on use of what was learned. See the OT Incident Response Guide.
Detection and measurement
- Capture point register: percentage of SPAN sessions and TAPs with a named owner and purpose.
- Clear-text credential flows: number of observed protocols carrying logins unencrypted, trending down.
- Switch change logging: percentage of OT managed switches sending configuration changes to the SOC.
- Unexplained capture: count of DET0800-style alerts not tied to approved analysts, each investigated.
Framework mapping
| Framework | Reference | How it applies |
|---|---|---|
| MITRE ATT&CK for ICS v20 | T0842; M0808, M0930, M0814, M0926, M0932; DET0800 | Technique, mitigations and analytics |
| MITRE ATT&CK Enterprise v20 | T1040 Network Sniffing | Host-level equivalent |
| NIST SP 800-53 Rev. 5 | SC-8 Transmission Confidentiality and Integrity, SC-7 Boundary Protection, AC-6 Least Privilege, SI-4 System Monitoring | Protecting traffic in transit, segmentation, limiting capture rights, monitoring |
| NIST CSF 2.0 | PR.DS-02, PR.IR-01, DE.CM-01 | Data in transit, network protection, network monitoring |
Common failure patterns
- Forgotten mirror sessions: SPAN sessions from old projects keep copying control traffic to unmanaged ports.
- Monitoring sensors left unhardened: the defender's capture becomes the attacker's.
- Clear-text engineering logins: one capture yields credentials for many controllers.
- Operators with local administrator rights: anyone can install a capture driver.
Practitioner checklist
- Keep a register of SPAN sessions, TAPs and monitoring sensors.
- Alert on capture drivers, raw sockets and capture tools from unapproved accounts.
- Alert on SPAN and mirror configuration changes from outside the management subnet.
- Remove local administrator rights from operator accounts.
- Enable encrypted protocol variants where supported and tested.
- Use static ARP for critical pairs where operations can maintain it.
- Rotate any credential seen in clear text and add MFA to remote access.
Standards and references
- MITRE ATT&CK for ICS: Network Sniffing (T0842)
- MITRE ATT&CK: Detection of Network Sniffing (DET0800)
- MITRE ATT&CK: Network Sniffing (T1040)
- MITRE ATT&CK: INCONTROLLER (S1045)
- CISA and partners: AA22-103A, APT Cyber Tools Targeting ICS/SCADA Devices
- CSIAC: Practical Industrial Control System (ICS) Cybersecurity, Discover and Defend Your Assets
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · MITRE ATT&CK T1040 Network Sniffing · OT Network Security Monitoring Guide · OT and ICS Identity and Access Guide