{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0864","id":"T0864","name":"Transient Cyber Asset","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0864","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"dc1bd4468f15adbdcba3cd62d714325452abc2626cf8520369b535c8638ca37a","description":"Adversaries may target devices that are transient across ICS networks and external networks. Normally, transient assets are brought into an environment by authorized personnel and do not remain in that environment on a permanent basis. (Citation: North American Electric Reliability Corporation June 2021) Transient assets are commonly needed to support management functions and may be more common in systems where a remotely managed asset is not feasible, external connections for remote access do not exist, or 3rd party contractor/vendor access is required. \n\nAdversaries may take advantage of transient assets in different ways. For instance, adversaries may target a transient asset when it is connected to an external network and then leverage its trusted access in another environment to launch an attack. They may also take advantage of installed applications and libraries that are used by legitimate end-users to interact with control system devices. \n\nTransient assets, in some cases, may not be deployed with a secure configuration leading to weaknesses that could allow an adversary to propagate malicious executable code, e.g., the transient asset may be infected by malware and when connected to an ICS environment the malware propagates onto other systems. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0864","external_id":"T0864"},{"source_name":"North American Electric Reliability Corporation June 2021","description":"North American Electric Reliability Corporation 2021, June 28 Glossary of Terms Used in NERC Reliability Standards Retrieved. 2021/10/11 ","url":"https://www.nerc.com/pa/Stand/Glossary%20of%20Terms/Glossary_of_Terms.pdf"}],"platforms":["Windows","Linux"],"environments":["cloud-hosted-endpoint","ics-ot","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0067","name":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component","category":"Windows and directory audit","description":"Creation of a logon session with account and logon-type context.","collection_focus":"Enable Audit Logon and collect successful session creation on the receiving host; join session/logon IDs rather than only account names.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["account","logon_id","logon_type","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"ics/T0864","id":"T0864","name":"Transient Cyber Asset","domain":"ics","platforms":["Windows","Linux"],"environments":["cloud-hosted-endpoint","ics-ot","onprem"],"source_url":"https://attack.mitre.org/techniques/T0864","technique_page":"techniques/ics/T0864/","page":"detections/ics/T0864/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":2,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0744","name":"Detection of Transient Cyber Asset","url":"https://attack.mitre.org/detectionstrategies/DET0744","stix_id":"x-mitre-detection-strategy--8ae936b6-b635-4104-bd11-81c18d90cf97","relationship_id":"relationship--cf8acb4a-4918-4155-99a7-ee938278bbca","description":"","analytics":[{"id":"AN1877","name":"Analytic 1877","guidance":"Real-time monitoring identifies a device establishing its first network connection to Industrial Control System (ICS) application servers from an Internet Protocol (IP) address or Media Access Control (MAC) address not previously seen in the environment, immediately following a new device association event on the network. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0744#AN1877","platforms":["Windows"],"tuning":[{"field":"ApprovedDeviceInventory","description":"Hardware ID inventory of all devices authorized to connect to the ICS network, ideally enforced via NAC/802.1X."},{"field":"NewDeviceWindow","description":"Time window after first network appearance within which access to ICS systems is considered part of the same onboarding/intrusion event."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"netflow:ipfix","channel":"IPFIX/NetFlow flow record (src/dst IP, src/dst port, protocol, packets/bytes/time): connection from newly-observed device to Industrial Control Systems (ICS) application server within new device window of first network appearance","platforms":["Windows"],"analytic_id":"AN1877","source_url":"https://attack.mitre.org/detectionstrategies/DET0744#AN1877","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"},{"component_id":"DC0067","component":"Logon Session Creation","name":"WinEventLog:Security","channel":"Windows Security Event ID 4624/4625: EventCode=4624 from a device Media Access Control (MAC) address/hardware-ID first observed on the network, not in approved device inventory","platforms":["Windows"],"analytic_id":"AN1877","source_url":"https://attack.mitre.org/detectionstrategies/DET0744#AN1877","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0067/"}]},{"id":"AN2254","name":"Analytic 2254","guidance":"Real-time monitoring identifies an Secure Shell (SSH) connection to an Industrial Control System (ICS) Linux asset from a source Internet Protocol (IP) address that appeared on the ICS network within a short window and is not in the approved device inventory. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows.","url":"https://attack.mitre.org/detectionstrategies/DET0744#AN2254","platforms":["Linux"],"tuning":[{"field":"ApprovedDeviceInventory","description":"Hardware ID inventory of all devices authorized to connect to the ICS network, ideally enforced via NAC/802.1X."},{"field":"NewDeviceWindow","description":"Time window after first network appearance within which access to ICS systems is considered part of the same onboarding/intrusion event."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"syslog:auth","channel":"Secure Shell (SSH) connection from source Internet Protocol (IP) address that appeared on Industrial Control Systems (ICS) network within new device window, not in approved device inventory","platforms":["Linux"],"analytic_id":"AN2254","source_url":"https://attack.mitre.org/detectionstrategies/DET0744#AN2254","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0067","name":"Logon Session Creation","tag":"Logon Session Creation","page":"telemetry/DC0067/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[],"mitigations":[{"id":"M0930","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M0930","kind":"course-of-action","description":"Segment and control software movement between business and OT environments by way of one directional DMZs. Web access should be restricted from the OT environment. Engineering workstations, including transient cyber assets (TCAs) should have minimal connectivity to external networks, including Internet and email, further limit the extent to which these devices are dual-homed to multiple networks. (Citation: North America Transmission Forum December 2019)\n","relationship_id":"relationship--798919d3-df8b-463f-b2be-4c1aa8089384","references":[{"source_name":"North America Transmission Forum December 2019","description":"North America Transmission Forum 2019, December NATF Transient Cyber Asset Guidance Retrieved. 2020/09/25 ","url":"https://www.natf.net/docs/natf/documents/resources/security/natf-transient-cyber-asset-guidance.pdf"}]},{"id":"M0941","name":"Encrypt Sensitive Information","url":"https://attack.mitre.org/mitigations/M0941","kind":"course-of-action","description":"Consider implementing full disk encryption, especially if engineering workstations are transient assets that are more likely to be lost, stolen, or tampered with. (Citation: National Institute of Standards and Technology April 2013)\n","relationship_id":"relationship--2fbb7867-79c5-4d45-9876-98c4041dd72e","references":[{"source_name":"National Institute of Standards and Technology April 2013","description":"National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"}]},{"id":"M0947","name":"Audit","url":"https://attack.mitre.org/mitigations/M0947","kind":"course-of-action","description":"Integrity checking of transient assets can include performing the validation of the booted operating system and programs using TPM-based technologies, such as Secure Boot and Trusted Boot. (Citation: Emerson Exchange) It can also include verifying filesystem changes, such as programs and configuration files stored on the system, executing processes, libraries, accounts, and open ports.   (Citation: National Security Agency February 2016)\n","relationship_id":"relationship--5041e17d-6349-4589-8c61-7b43964b5f9b","references":[{"source_name":"Emerson Exchange","description":"Emerson Exchange   Increase Security with TPM, Secure Boot, and Trusted Boot Retrieved. 2020/09/25 ","url":"https://emersonexchange365.com/products/control-safety-systems/f/plc-pac-systems-industrial-computing-forum/8383/increase-security-with-tpm-secure-boot-and-trusted-boot"},{"source_name":"National Security Agency February 2016","description":"National Security Agency 2016, February Position Zero: Integrity Checking Windows-Based ICS/SCADA Systems Retrieved. 2020/09/25 ","url":"https://apps.nsa.gov/iaarchive/library/ia-guidance/security-configuration/industrial-control-systems/position-zero-integrity-checking-windows-based-ics-scada-systems.cfm"}]},{"id":"M0949","name":"Antivirus/Antimalware","url":"https://attack.mitre.org/mitigations/M0949","kind":"course-of-action","description":"Install anti-virus software on all workstation and transient assets that may have external access, such as to web, email, or remote file shares.\n","relationship_id":"relationship--6c15ec9f-2b48-419c-adc1-f989833f6187","references":[]},{"id":"M0951","name":"Update Software","url":"https://attack.mitre.org/mitigations/M0951","kind":"course-of-action","description":"Update software on control network assets when possible. If feasible, use modern operating systems and software to reduce exposure to known vulnerabilities.\n","relationship_id":"relationship--b8edcf0a-ec53-4203-b3ad-2cc734a1f1dd","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0864":"/ttp-simulation/techniques/ics/T0864/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0864","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0067","collector":"illustrative-lab-collector","observation":{"account":"LAB\\analyst","logon_id":"0x12345","logon_type":3,"source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}