T0887 Wireless Sniffing: Protecting Industrial Radio Links from Interception

Wireless Sniffing (T0887) is the passive capture of radio traffic used for remote control and reporting in industrial and distributed systems, and because it transmits nothing it leaves almost no trace. MITRE ATT&CK for ICS lists it under both Discovery and Collection, and names WirelessHART, Zigbee, WIA-FA and the 700 MHz public safety spectrum as examples of the radio links involved. What an adversary captures today can be studied, decoded and replayed later, as the 2017 Dallas siren incident cited by ATT&CK suggests. This guide is for OT engineers, radio and instrumentation teams and security architects: where industrial radio sits, what really reduces the risk, what can and cannot be detected, and how to respond. For the matrix as a whole see the MITRE ATT&CK for ICS Guide.

Key takeaways

• You cannot detect a pure listener. A receiver that never transmits is invisible on the network, so prevention (encryption, authentication, limited propagation) carries nearly all of the weight.
• ATT&CK lists two mitigations. Encrypt Network Traffic (M0808) and Minimize Wireless Signal Propagation (M0806); both are design decisions made at procurement and installation time.
• Encryption without message authentication is not enough. Captured commands that can be replayed are the real danger; require authenticated messages with replay protection, not only confidentiality.
• Detection targets the edges. ATT&CK's analytics look for unknown radio signatures, devices heard from the wrong place, and OT hosts switching wireless adapters into monitor mode.
• Treat sniffing as the first step. Captured traffic feeds Wireless Compromise (T0860) and replay of commands, so an inventory of every radio link and its key management is the starting point.

What T0887 covers and why OT radio is different

ATT&CK for ICS v20 (page last modified 13 October 2026) describes T0887 as capturing radio frequency communication used for remote control and reporting in distributed environments. It notes that RF frequencies range from 3 kHz to 300 GHz but are commonly between 300 MHz and 6 GHz, that wavelength and frequency shape how a signal travels through air, walls and trees, and that capture can use software defined radio, a handheld radio or a computer with a demodulator tuned to the right frequency. Information can be captured whether or not the sniffing device is the intended destination, and the technique is most useful to an adversary when traffic is not encrypted.

The OT angle matters for three reasons. Industrial radio often carries control and alarm traffic, not just data. Links are long lived, with devices that stay in the field for years and keys that may be rarely changed. And many links cross the site fence: telemetry to remote pumping stations, outdoor sirens and wide-area sensors have to travel through public space by design.

NIST AMS 300-4 notes that most industrial wireless devices use unlicensed ISM bands (902-928 MHz, 2.400-2.4835 GHz and 5.725-5.875 GHz), which are shared and open to interference, and suggests licensed spectrum for safety-critical uses. From a sniffing point of view the band matters less than the protection on the link: anyone with a suitable receiver can hear either.

Related techniques have their own pages: T0860 Wireless Compromise (using radio to gain access), T0842 Network Sniffing (capture on wired OT networks, mirrored by Enterprise T1040; see the MITRE ATT&CK T1040 Network Sniffing).

The case ATT&CK cites: the 2017 Dallas sirens

ATT&CK records no software or group procedure examples for T0887. It cites the April 2017 Dallas siren incident, where it is suspected that adversaries captured wireless command broadcasts on a 700 MHz frequency during a regular system test and later replayed them to set off the alarms. The city never disclosed exactly how the system was compromised. Bastille's analysis at the time set out plausible scenarios: on analog systems, command tone sequences sent to each siren could be recorded before a monthly test and replayed if they are sent with no security; digital systems remain exposed if encryption is missing or flawed, including weak key management, missing initialisation vectors that allow replay, and poorly implemented over-the-air rekeying. The lesson for asset owners is that a scheduled, predictable test broadcast gives a listener a clean recording of exactly the command they want.

Prevention: decide it at design and procurement

1. Inventory every radio link. Record technology, frequency, devices, gateways, what the link carries (monitoring only, or control and alarms), the encryption and authentication in use, key owner and last rekey date. Include links run by contractors and integrators. The OT Asset Visibility Guide covers asset discovery generally.
2. Encrypt and authenticate (M0808). ATT&CK's mitigation is to use strong cryptographic techniques and protocols to prevent eavesdropping. NIST AMS 300-4 states that devices within a network should be authenticated and that authentication can matter more than encryption for process availability. For control traffic insist on both, with replay protection.
3. Manage keys like credentials. Change factory join keys at commissioning, rotate network keys on a schedule and after staff or contractor changes, and use over-the-air rekeying where the technology supports it, as NIST AMS 300-4 suggests.
4. Limit propagation (M0806). ATT&CK lists reducing transmission power, adjusting antenna gain so coverage stops at the organisational boundary, and RF shielding. Run a site survey before and after changes so reliability is not traded away.
5. Keep control off radio where it is not needed. For safety-critical or high-consequence commands, prefer wired links or licensed spectrum, and keep wireless to monitoring where the process allows.
6. Write requirements into contracts. Ask suppliers which security modes their radios support, how keys are provisioned and replaced, and whether command messages carry authentication and replay counters.

Testing and rollback: enable security modes on a single gateway or cell first, confirm join, latency and alarm delivery for a full operating cycle, and keep the previous gateway configuration and key set stored offline so the change can be reversed if devices drop off.

Detection: what is possible

ATT&CK v20's detection strategy for T0887 accepts that only indirect evidence exists and offers three analytics.

ATT&CK's fidelity gate applies: do not alert on novelty alone, and suppress normal commissioning, diagnostics and approved engineering activity. In practice, use the wireless intrusion detection features of your Wi-Fi infrastructure, the diagnostics of WirelessHART and ISA100 gateways, and periodic spectrum surveys at sites with critical radio links. See the Wireless intrusion detection guide. Watch the follow-on signs too: replayed or out-of-sequence commands, unexpected device joins and sudden interference, covered in the Physical Layer and Wireless Jamming Guide.

Decision guidance

Safe response

• Assume captured traffic can be replayed: if a link without authentication is found or a listener is suspected, agree temporary operating rules with operations, for example manual confirmation of remote commands.
• Rotate keys in a planned window: rekeying a mesh can drop devices; schedule it with instrument technicians present.
• Preserve evidence: keep spectrum recordings, gateway logs and join records, and the host logs that showed monitor mode or capture drivers.
• Look for the next step: review gateway and controller logs for joins or commands that did not come from known devices.

The OT Incident Response Guide sets out roles and safety checks.

Metrics that show it is working

• Percentage of industrial radio links in the inventory with a named owner.
• Percentage of links carrying control or alarm traffic with encryption and message authentication turned on.
• Percentage of networks where factory or default join keys have been replaced.
• Median age of network keys against the rotation target.
• Number of unknown radio devices found per spectrum survey, and time to resolve each.

Framework mapping

Common failure patterns

• Control commands over unauthenticated radio: the scenario ATT&CK cites for the Dallas sirens, where captured broadcasts were suspected to have been replayed.
• Factory join keys left in place: security modes are on, but every site from the same integrator shares the same key.
• Keys never rotated: long-lived field devices keep the commissioning key for the life of the plant.
• Coverage far beyond the fence: high-gain antennas installed for reliability without checking where the signal ends.
• Radio missing from the asset inventory: wireless links installed by contractors are unknown to the security team until an incident.

Practitioner checklist

• Inventory every industrial radio link, what it carries and how it is protected.
• Turn on encryption and message authentication with replay protection for control and alarm traffic.
• Replace factory join keys at commissioning and rotate keys on a schedule.
• Tune transmit power and antennas so coverage ends near the site boundary, verified by survey.
• Deploy ATT&CK's monitor-mode and capture-driver analytics on OT Windows and Linux hosts.
• Use gateway diagnostics and periodic spectrum surveys at sites with critical radio links.
• Write wireless security requirements into supplier and integrator contracts.

Standards and references

• MITRE ATT&CK for ICS: T0887 Wireless Sniffing
• MITRE ATT&CK for ICS: M0808 Encrypt Network Traffic
• MITRE ATT&CK for ICS: M0806 Minimize Wireless Signal Propagation
• NIST: AMS 300-4, Guide to Industrial Wireless Systems Deployments
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• NIST: SP 800-53 Rev. 5, Security and Privacy Controls
• Bastille: Dallas Siren Attack

Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · Wireless intrusion detection · HART, WirelessHART and ISA100 Security Guide · Industrial IoT (IIoT) Security Guide · OT Security Guide