{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0882","id":"T0882","name":"Theft of Operational Information","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0882","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"1b9b85421b43174f4e83987ef0851f5c0b2a69b9e3c59ac2c51c1aa464654397","description":"Adversaries may steal operational information on a production environment as a direct mission outcome for personal gain or to inform future operations. This information may include design documents, schedules, rotational data, or similar artifacts that provide insight on operations.    In the Bowman Dam incident, adversaries probed systems for operational data. (Citation: Mark Thompson March 2016) (Citation: Danny Yadron December 2015)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0882","external_id":"T0882"},{"source_name":"Danny Yadron December 2015","description":"Danny Yadron 2015, December 20 Iranian Hackers Infiltrated New York Dam in 2013 Retrieved. 2019/11/07 ","url":"https://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559"},{"source_name":"Mark Thompson March 2016","description":"Mark Thompson 2016, March 24 Iranian Cyber Attack on New York Dam Shows Future of War Retrieved. 2019/11/07 ","url":"https://time.com/4270728/iran-cyber-attack-dam-fbi/"}],"platforms":["None"],"environments":["ics-ot"],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","parent":null,"children":[],"telemetry":[{"id":"proposed-operational-document-access-audit","name":"Operational document access audit","page":"telemetry/proposed-operational-document-access-audit/","kind":"proposed_input","category":"Application and service audit","description":"Access to operational documentation through a repository or document service.","collection_focus":"Enable document-read/download audit on the lab repository; retain document ID, identity and result without storing document bodies.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["document_id","actor","action","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-operational-document-access-audit","collector":"illustrative-lab-collector","observation":{"document_id":"lab-procedure-1","actor":"lab-reader","action":"download","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"proposed_input","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"proposed-egress-and-transfer-records","name":"Egress and transfer records","page":"telemetry/proposed-egress-and-transfer-records/","kind":"proposed_input","category":"Network and protocol telemetry","description":"Outbound connections/transfers visible at a selected gateway or application.","collection_focus":"Collect outbound flow/proxy/application transfer metadata with direction and bytes; distinguish application exports from network delivery.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source","destination","direction","bytes_sent"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-egress-and-transfer-records","collector":"illustrative-lab-collector","observation":{"source":"192.0.2.10","destination":"198.51.100.20","direction":"outbound","bytes_sent":128}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"proposed_input","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"ics/T0882","id":"T0882","name":"Theft of Operational Information","domain":"ics","platforms":["None"],"environments":["ics-ot"],"source_url":"https://attack.mitre.org/techniques/T0882","technique_page":"techniques/ics/T0882/","page":"detections/ics/T0882/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0732","name":"Detection of Theft of Operational Information","url":"https://attack.mitre.org/detectionstrategies/DET0732","stix_id":"x-mitre-detection-strategy--2145faf1-28da-4ebc-9730-f2e2a8764ced","relationship_id":"relationship--8e11c3ef-4ee3-4a91-868f-d0a1c10d538b","description":"","analytics":[{"id":"AN1865","name":"Analytic 1865","guidance":"No standard detection method currently exists for this technique.","url":"https://attack.mitre.org/detectionstrategies/DET0732#AN1865","platforms":["None"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[{"id":"proposed-operational-document-access-audit","name":"Operational document access audit","tag":"Proposed: Operational document access audit","page":"telemetry/proposed-operational-document-access-audit/","kind":"proposed_input"},{"id":"proposed-egress-and-transfer-records","name":"Egress and transfer records","tag":"Proposed: Egress and transfer records","page":"telemetry/proposed-egress-and-transfer-records/","kind":"proposed_input"}],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0038","name":"Duqu","url":"https://attack.mitre.org/software/S0038","kind":"malware","description":"[Duqu](https://attack.mitre.org/software/S0038)'s purpose is to gather intelligence data and assets from entities such as industrial infrastructure and system manufacturers, amongst others not in the industrial sector, in order to more easily conduct a future attack against another third party.(Citation: Symantec W32.Duqu)","relationship_id":"relationship--792324b4-064a-430c-8ffc-7f7acd537778","references":[{"source_name":"Symantec W32.Duqu","description":"Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015.","url":"https://web.archive.org/web/20111213083345/https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_duqu_the_precursor_to_the_next_stuxnet.pdf"}]},{"id":"S0143","name":"Flame","url":"https://attack.mitre.org/software/S0143","kind":"malware","description":"[Flame](https://attack.mitre.org/software/S0143) can collect AutoCAD design data and visio diagrams as well as other documents that may contain operational information. (Citation: Kevin Savage and Branko Spasojevic)","relationship_id":"relationship--79d05cb2-ded0-4847-b52e-af7af421f303","references":[{"source_name":"Kevin Savage and Branko Spasojevic","description":"Kevin Savage and Branko Spasojevic   W32.Flamer Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190930124504/https:/www.symantec.com/security-center/writeup/2012-052811-0308-99"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) sends exfiltrated data from the victims system using HTTPS POST messages sent to the C2 system. (Citation: McAfee Labs October 2019) (Citation: SecureWorks September 2019)","relationship_id":"relationship--6ed07095-c23a-4676-807f-a544deaeb274","references":[{"source_name":"McAfee Labs October 2019","description":"McAfee Labs 2019, October 02 McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service  What The Code Tells Us Retrieved. 2021/04/12 ","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us"},{"source_name":"SecureWorks September 2019","description":"SecureWorks 2019, September 24 REvil/Sodinokibi Ransomware Retrieved. 2021/04/12 ","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"id":"S1000","name":"ACAD/Medre.A","url":"https://attack.mitre.org/software/S1000","kind":"malware","description":"[ACAD/Medre.A](https://attack.mitre.org/software/S1000) can collect AutoCad files with drawings. These drawings may contain operational information. (Citation: ESET)\n","relationship_id":"relationship--228b9a13-0545-4ecf-99ff-be02addaf7fe","references":[{"source_name":"ESET","description":"ESET   ACAD/Medre.A: 10000s of AutoCAD Designs Leaked in Suspected Industrial Espionage Retrieved. 2021/04/13 ","url":"https://www.welivesecurity.com/wp-content/uploads/200x/white-papers/ESET_ACAD_Medre_A_whitepaper.pdf"}]}],"actors":[],"mitigations":[{"id":"M0803","name":"Data Loss Prevention","url":"https://attack.mitre.org/mitigations/M0803","kind":"course-of-action","description":"Apply DLP to protect the confidentiality of information related to operational processes, facility locations, device configurations, programs, or databases that may have information that can be used to infer organizational trade-secrets, recipes, and other intellectual property (IP).\n","relationship_id":"relationship--bc74ff8f-d5fa-40fb-8c0b-f16af3ff36e3","references":[]},{"id":"M0809","name":"Operational Information Confidentiality","url":"https://attack.mitre.org/mitigations/M0809","kind":"course-of-action","description":"Example mitigations could include minimizing its distribution/storage or obfuscating the information (e.g., facility coverterms, codenames).  In many cases this information may be necessary to support critical engineering, maintenance, or operational functions, therefore, it may not be feasible to implement.\n","relationship_id":"relationship--69576d3c-d0e8-459e-9f2e-0b9c560b2e04","references":[]},{"id":"M0922","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M0922","kind":"course-of-action","description":"Protect files stored locally with proper permissions to limit opportunities for adversaries to interact and collect information from databases. (Citation: Keith Stouffer May 2015) (Citation: National Institute of Standards and Technology April 2013)\n","relationship_id":"relationship--2e5f338d-92c4-4647-8fef-7c901ff774f5","references":[{"source_name":"Keith Stouffer May 2015","description":"Keith Stouffer 2015, May Guide to Industrial Control Systems (ICS) Security Retrieved. 2018/03/28 ","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r2.pdf"},{"source_name":"National Institute of Standards and Technology April 2013","description":"National Institute of Standards and Technology 2013, April Security and Privacy Controls for Federal Information Systems and Organizations Retrieved. 2020/09/17 ","url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf"}]},{"id":"M0941","name":"Encrypt Sensitive Information","url":"https://attack.mitre.org/mitigations/M0941","kind":"course-of-action","description":"Encrypt any operational data with strong confidentiality requirements, including organizational trade-secrets, recipes, and other intellectual property (IP).\n","relationship_id":"relationship--cb4d802e-df5b-4017-81dd-47f65fff23a3","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0882":"/ttp-simulation/techniques/ics/T0882/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0882","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-operational-document-access-audit","collector":"illustrative-lab-collector","observation":{"document_id":"lab-procedure-1","actor":"lab-reader","action":"download","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-egress-and-transfer-records","collector":"illustrative-lab-collector","observation":{"source":"192.0.2.10","destination":"198.51.100.20","direction":"outbound","bytes_sent":128}}]}}