Many of the best known attacks on industrial operators started with an email attachment opened by someone on the business network, long before any controller was touched. MITRE ATT&CK for ICS tracks this as T0865 Spearphishing Attachment, an Initial Access technique for Windows, Linux and embedded assets that usually relies on T0863 User Execution to run. The behaviour itself is the same as Enterprise T1566.001, and the general email defences are covered in the MITRE ATT&CK T1566 Phishing guide and the Email Security Guide. This shorter page covers what differs in OT: who is targeted, why email should not reach control zones at all, MITRE's OT-specific detections and how to stop a phished business laptop becoming a path into the plant.
Key takeaways
- Energy and utilities are repeat targets. ATT&CK records spearphishing attachments in campaigns against oil and gas pipeline operators and electric utilities, and BlackEnergy in an energy-sector campaign using malicious Word documents.
- The phished host is rarely the target. The attachment buys a foothold; the risk is the route from that host to OT, so segmentation matters as much as the email filter.
- Keep email out of control zones. MITRE advises restricting email in critical process environments and disabling attachments where email is still needed.
- Office spawning a shell is the key signal. MITRE's Windows analytic looks for Outlook, Word or Excel launching cmd, PowerShell, wscript or mshta on an ICS workstation.
- Train the people with OT access first. Engineers, operators and OT administrators are the recipients that matter most.
What is different in OT
- Targets: ATT&CK describes a December 2011 to February 2012 spearphishing campaign against oil and natural gas organisations and their employees, citing CISA advisory AA21-201A. Groups recorded using the technique against energy include ALLANITE, which ATT&CK says used spear phishing to gain access to energy sector environments, and Lazarus Group, linked by ATT&CK's sources to campaigns against a US electric grid company.
- Lures: ATT&CK records Backdoor.Oldrea distributed through a trojanised installer attached to emails, and OilRig using malicious Excel attachments. Vendor-themed installers and documents are plausible lures for engineers who routinely download vendor software.
- Where it lands: in a well segmented site the attachment opens on a corporate laptop. In a flat or dual-homed site it can open on a host that also reaches the control network, which is why MITRE's detections specifically watch ICS engineering and operator workstations.
For the full ICS matrix see the MITRE ATT&CK for ICS Guide.
Procedure examples in ATT&CK for ICS
| Group or software | What ATT&CK records |
|---|---|
| BlackEnergy (S0089) | Targeted energy sector organisations in a wide spearphishing campaign using malicious Microsoft Word attachments |
| Backdoor.Oldrea (S0093) | Remote access tool distributed through a trojanised installer attached to emails |
| ALLANITE (G1000) | Used spear phishing to gain access to energy sector environments |
| Lazarus Group (G0032) | Spearphishing documents with embedded malicious payloads; highly targeted campaigns against a US electric grid company |
| OilRig (G0049) | Spearphishing emails with malicious Excel attachments |
| APT33 (G0064) | Spear phishing emails with links to HTML application files embedded with malicious code; targeted campaigns against US government and private sector |
For the malware families see the ICS Malware History Guide.
Mitigations MITRE maps to T0865
| Mitigation | MITRE's guidance | OT implementation |
|---|---|---|
| M0921 Restrict Web-Based Content | Consider restricting email in critical process environments; disable downloads and attachments where email is still necessary | No mail client or webmail on HMIs, engineering workstations or historians; block SMTP, IMAP and webmail at the OT boundary |
| M0949 Antivirus/Antimalware | Deploy anti-malware on all systems that support external email | Corporate endpoints used by OT staff get the same protection as any other; OT hosts should not support external email at all |
| M0931 Network Intrusion Prevention | Network intrusion prevention and systems that scan and remove malicious attachments can block activity | Attachment sandboxing and file-type blocking at the mail gateway; see the Email Security Guide |
| M0917 User Training | Train users to identify social engineering and spearphishing | Role-specific sessions for engineers and operators, with vendor-themed and installer lures |
On Windows endpoints used by OT staff, Microsoft Defender attack surface reduction rules address the attachment-to-execution step: "Block all Office applications from creating child processes" (GUID d4f940ab-401b-4efc-aadc-ad5f3c50688a), "Block executable content from email client and webmail" (be9ba2d9-53ea-4cdc-84e5-9b1eeee46550) and "Block Office applications from creating executable content" (3b576869-a4ec-4529-8536-b80a7769e899). Microsoft recommends audit mode before block.
Detection and measurement
ATT&CK for ICS v20 detection strategy DET0781 gives three analytics, each gated so alerts fire when the session breaks approved identity, host or zone policy and is followed by access to a protected OT asset or another security-relevant event.
| Platform | Signal (from MITRE's analytics) | Log source |
|---|---|---|
| Windows | Outlook, Word or Excel spawns cmd.exe, powershell.exe, wscript.exe or mshta.exe on a host in the ICS workstation inventory, right after an attachment is opened | Sysmon event 1 (process create) |
| Linux | An email client on an ICS Linux workstation spawns a child process inconsistent with normal email handling | auditd execve records |
| Embedded | A field device or embedded engineering terminal receives malformed or exploit data on its communication interface from an external source | Network security monitoring content inspection |
Two extra signals are worth adding: any SMTP, IMAP or webmail traffic leaving an OT zone (it should not exist), and connections into OT from a corporate host that recently triggered an email-borne malware alert. See the OT Network Security Monitoring Guide.
Metrics:
- Number of OT hosts with a mail client or webmail access (target: zero).
- Phishing simulation report rate for staff with OT access, compared with the organisation as a whole.
- Percentage of OT staff endpoints with the Office child process and email executable rules in block mode.
- Time from an email-borne malware alert on a corporate host to review of that host's OT access paths.
Implementing the controls
- Find email in OT: inventory mail clients, browsers with webmail access and mail flows on OT hosts, and confirm no OT host is dual-homed to the corporate network.
- Remove or block: uninstall mail clients from HMIs and engineering workstations where vendors allow, and block mail protocols and webmail at the OT boundary.
- Harden staff endpoints: put the attack surface reduction rules in audit mode, review hits for two to four weeks, then move to block; roll back a single rule by setting it to audit if a business macro breaks.
- Separate the path: make OT access from corporate devices go through a jump host or remote access service, never direct. See the OT Remote Access Guide.
- Train and test: run targeted training for OT staff and measure reporting.
Where identity fits
A phished user's credentials are often worth more than the malware. If the same account signs in to corporate email and to OT jump hosts, one opened attachment can become valid OT access. Give OT access separate accounts, require multi-factor authentication at the IT to OT boundary, and keep vendor and service credentials out of mailboxes. See the OT and ICS Identity and Access Guide.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK for ICS v20 | T0865; T0863 User Execution; M0921, M0949, M0931, M0917; DET0781 | Technique, execution step, mitigations and detections |
| MITRE ATT&CK Enterprise v20 | T1566.001 Spearphishing Attachment | Enterprise equivalent |
| NIST SP 800-53 Rev. 5 | SI-8 Spam Protection; SI-3 Malicious Code Protection; AT-2 Literacy Training and Awareness; SC-7 Boundary Protection | Mail filtering, anti-malware, awareness and IT to OT boundary |
| NIST CSF 2.0 | PR.AT-01; DE.CM-09 | Awareness training and endpoint monitoring |
Common failure patterns
- Email on the HMI. A browser on an operator station with webmail access brings attachments straight into the control zone.
- Dual-homed engineering laptops. The laptop that reads email in the morning programs a controller in the afternoon.
- Shared credentials across IT and OT. A phished corporate password opens the OT jump host.
- Generic training. Engineers see lures themed on vendor software and project files, not parcel deliveries.
- Treating the alert as an IT ticket. A malware alert on an OT engineer's corporate laptop needs an OT access review, not only a reimage.
Practitioner checklist
- Confirm no HMI, engineering workstation or historian has email or webmail access.
- Block mail protocols and webmail at the OT boundary.
- Enforce the Office child process and email executable ASR rules on OT staff endpoints.
- Route all IT to OT access through a jump host with multi-factor authentication.
- Use separate accounts for OT access.
- Alert on Office applications spawning shells on hosts in the ICS workstation inventory.
- Run phishing training themed for engineers and operators.
- Review OT access whenever an OT user's corporate endpoint has an email-borne malware alert.
Standards and references
- MITRE ATT&CK: Spearphishing Attachment (ICS)
- MITRE ATT&CK: Phishing, Spearphishing Attachment (Enterprise)
- MITRE ATT&CK: BlackEnergy
- MITRE ATT&CK: ALLANITE
- Microsoft Learn: Attack surface reduction rules reference
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: MITRE ATT&CK T1566 Phishing · MITRE ATT&CK T1204 User Execution · OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide · OT Security Guide