User Execution (T0863) is an adversary relying on someone in the organisation to run malicious code for them, by opening a document, running an installer or granting a file more permissions. The technique is the same as in IT; what changes in OT is who the user is and what they can reach. An engineer who opens a trojanised vendor installer or an infected project file on an engineering workstation puts the code one step from the controllers. MITRE ATT&CK for ICS lists T0863 under Execution for Embedded, Windows and Linux platforms. This page covers what differs in OT and the ICS cases ATT&CK records; for the general defences (macro blocking, application control, attachment handling) see the enterprise T1204 User Execution guide.
Key takeaways
- The engineering workstation is the high-value target. Code that runs there inherits access to project files, engineering software and controller connections.
- Trusted vendor software has been the lure. ATT&CK records Backdoor.Oldrea executing when a user opened a trojanised installer.
- Project files can carry code. ATT&CK records Stuxnet infecting the Siemens manager components that open project files, so opening a project spread the infection.
- Application control fits OT well. OT hosts run a small, stable software set, which makes allowlisting and code signing more practical than on office PCs.
- ICS data is what the actors wanted. In the pipeline campaign described in AA21-201A, the actors went after SCADA documents, RTU details and ICS permission groups.
What changes in OT
| Aspect | Enterprise IT | OT |
|---|---|---|
| Typical lure | Email attachment or link | Also vendor installers, firmware tools, project files and documents brought in on removable media or by integrators |
| Who runs it | Any employee | Engineers, technicians and integrators with controller access |
| Consequence | Data loss, ransomware | Path to controller logic, loss of view or control |
| Software baseline | Large and changing | Small and stable, so allowlisting is practical |
| Patching and agents | Routine | Constrained by vendor support and availability, so prevention must not depend on frequent updates |
The procedure examples and what they teach
- Backdoor.Oldrea (S0093): ATT&CK records that execution relied on a user opening a trojanised installer attached to an email, and that the malware was also distributed through supply chain compromise. The lesson: verify the source and signature of vendor software before it reaches OT. See the MITRE ATT&CK for ICS T0862 Supply Chain Compromise guide.
- Stuxnet (S0603): ATT&CK records that Stuxnet infected DLLs of the Siemens Simatic manager used to open project files, so a clean project opened with a compromised manager became infected, and an infected project triggered loading of a malicious DLL. The lesson: project files are executable content in practice and need the same handling as installers.
- Pipeline intrusion campaign, 2011 to 2013: ATT&CK cites this campaign as spearphishing that needed user action to execute. CISA and the FBI's advisory AA21-201A (July 2021) reports that from December 2011 through at least February 2012 state-sponsored actors targeted 23 US pipeline operators, with 13 confirmed compromises, and took ICS-related material including RTU site details, system manuals and ICS permission groups. The advisory found no evidence they changed pipeline operations.
- Bad Rabbit (S0606) and REvil (S0496): ATT&CK lists these IT ransomware families under T0863: Bad Rabbit disguised as an Adobe Flash installer, REvil run when a user opened a JavaScript file in a zipped phishing attachment. They show that general-purpose ransomware lures reach OT-adjacent hosts too. See the OT Ransomware Response Playbook.
Prevention: ATT&CK mitigations in practice
| ATT&CK mitigation | What ATT&CK says for T0863 | OT application |
|---|---|---|
| M0938 Execution Prevention | Application control may prevent executables masquerading as other files | Allowlist engineering, HMI and historian software; start in audit mode. See the Application Allowlisting Guide |
| M0945 Code Signing | Prevent the use of unsigned executables, installers and scripts | Check vendor signatures before installing; allow only signed code where the platform supports it |
| M0949 Antivirus/Antimalware | Detect malicious files that rely on user execution, such as Office macros and installers | Use only vendor-approved products and exclusions on OT hosts; scan media at a kiosk before it enters OT |
| M0921 Restrict Web-Based Content | Block unknown or unused file types in transit, such as .scr, .exe, .pif and .cpl | OT hosts should not browse the internet; deliver files through a controlled transfer point |
| M0931 Network Intrusion Prevention | Block activity from links to malicious downloads | Apply at the IT/OT boundary and the file transfer point |
| M0917 User Training | Raise awareness of phishing and spearphishing | Train engineers and integrators on vendor-themed lures and on handling project files and media |
AA21-201A adds disabling Office macros and application allowlisting on IT, and allowlisting HMIs on the ICS side. See the Office Macro Blocking Guide and the Engineering Workstation Security Guide.
Detection: ATT&CK v20 analytics
MITRE's v20 detection strategy for T0863 has three analytics, each with ATT&CK's OT operational fidelity gate: alert only when the session breaks the approved identity, source and zone policy and is corroborated by access to a protected OT asset, execution or a configuration change; suppress approved shift activity, vendor support, commissioning and documented remote-access windows.
| Where | What the analytic looks for | Data needed |
|---|---|---|
| Windows ICS workstations | A process chain starting from a user opening a file or clicking a link that spawns processes outside the expected viewer children, then connects to destinations not on the approved list | Sysmon Event ID 1 (process creation) and Event ID 3 (network connection) |
| Linux ICS workstations | A user-facing application spawning a child process outside its expected baseline | Linux audit (auditd) execve records |
| Embedded devices | Device I/O changes inconsistent with programmed logic that coincide with operator interaction on a connected engineering terminal | OT network detection behavioural alerts |
The baseline is short on OT hosts: engineering suites, HMI runtimes, a document viewer and a handful of utilities. That makes unexpected children of those applications a high-quality signal.
How to implement
- Define the software baseline for each engineering workstation, HMI and historian with the system owners.
- Set up a controlled file transfer point where installers, project files and documents are scanned and signature-checked before they enter OT.
- Deploy application control in audit mode for a full maintenance cycle, review blocks with engineering, then enforce one host group at a time with a documented rollback.
- Remove email and web browsing from OT hosts where operations allows it.
- Turn on process and network logging on Windows and Linux OT hosts and forward it to the OT SOC.
- Train engineers and integrators on the specific lures recorded in ATT&CK: vendor installers and project files.
Detection and measurement
- Allowlisting coverage: percentage of engineering workstations and HMIs with application control enforced.
- Controlled transfer: percentage of files entering OT through the scanning and signature-check point.
- Logging coverage: percentage of OT Windows and Linux hosts sending process creation logs.
- Internet exposure: number of OT hosts with email or web access (target zero where feasible).
Where identity fits
Code a user runs inherits that user's rights. Shared engineering logons and permanent local administrator rights on workstations turn one opened file into broad access. Use named accounts, remove standing admin rights, and give integrators separate accounts that are enabled only for their work window. See the OT and ICS Identity and Access Guide.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | ICS T0863; enterprise T1204, T1204.002; ICS T0865 | Execution by a user; the usual spearphishing delivery |
| NIST SP 800-53 Rev. 5 | CM-7, SI-3, SI-7, AT-2 | Least functionality, malicious code protection, integrity, awareness training |
| NIST CSF 2.0 | PR.PS-05, PR.AT-01, DE.CM-09 | Preventing unauthorised software, training, monitoring hosts |
Common failure patterns
- Vendor software installed straight from a download or a technician's laptop without a signature check.
- Project files treated as data and exchanged freely, despite the Stuxnet precedent.
- Email and browsing on engineering workstations for convenience.
- Application control left in audit mode indefinitely because nobody owns the review.
Practitioner checklist
- Document the approved software set for each OT host type.
- Route installers, project files and documents through a scanning and signature-check point.
- Enforce application control on engineering workstations and HMIs after audit-mode tuning.
- Remove email and web access from OT hosts where feasible.
- Log process creation and network connections on OT hosts.
- Use named accounts and remove standing local admin rights.
- Train engineers and integrators on vendor-themed and project-file lures.
Standards and references
- MITRE ATT&CK for ICS: User Execution (T0863)
- MITRE ATT&CK: User Execution (T1204)
- MITRE ATT&CK: Backdoor.Oldrea (S0093)
- MITRE ATT&CK: Stuxnet (S0603)
- CISA and FBI: AA21-201A Chinese Gas Pipeline Intrusion Campaign, 2011 to 2013
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS T0865 Spearphishing Attachment · T1204 User Execution · MITRE ATT&CK for ICS Guide · Engineering Workstation Security Guide · MITRE ATT&CK for ICS T0847 Replication Through Removable Media · Application Allowlisting Guide