{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0883","id":"T0883","name":"Internet Accessible Device","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0883","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"99e4ab3a00904573ca2b5264af870e8e017f73fa6d0b8c2c381159fed5e3f8dc","description":"Adversaries may gain access into industrial environments through systems exposed directly to the internet for remote access rather than through [External Remote Services](https://attack.mitre.org/techniques/T0822). Internet Accessible Devices are exposed to the internet unintentionally or intentionally without adequate protections. This may allow for adversaries to move directly into the control system network. Access onto these devices is accomplished without the use of exploits, these would be represented within the [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T0819) technique.\n\nAdversaries may leverage built in functions for remote access which may not be protected or utilize minimal legacy protections that may be targeted. (Citation: NCCIC January 2014) These services may be discoverable through the use of online scanning tools. \n\nIn the case of the Bowman dam incident, adversaries leveraged access to the dam control network through a cellular modem. Access to the device was protected by password authentication, although the application was vulnerable to brute forcing. (Citation: NCCIC January 2014) (Citation: Danny Yadron December 2015) (Citation: Mark Thompson March 2016)\n\nIn Trend Micros manufacturing deception operations adversaries were detected leveraging direct internet access to an ICS environment through the exposure of operational protocols such as Siemens S7, Omron FINS, and EtherNet/IP, in addition to misconfigured VNC access. (Citation: Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0883","external_id":"T0883"},{"source_name":"Danny Yadron December 2015","description":"Danny Yadron 2015, December 20 Iranian Hackers Infiltrated New York Dam in 2013 Retrieved. 2019/11/07 ","url":"https://www.wsj.com/articles/iranian-hackers-infiltrated-new-york-dam-in-2013-1450662559"},{"source_name":"Mark Thompson March 2016","description":"Mark Thompson 2016, March 24 Iranian Cyber Attack on New York Dam Shows Future of War Retrieved. 2019/11/07 ","url":"https://time.com/4270728/iran-cyber-attack-dam-fbi/"},{"source_name":"NCCIC January 2014","description":"NCCIC 2014, January 1 Internet Accessible Control Systems At Risk Retrieved. 2019/11/07 ","url":"https://www.us-cert.gov/sites/default/files/Monitors/ICS-CERT_Monitor_Jan-April2014.pdf"},{"source_name":"Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler","description":"Stephen Hilt, Federico Maggi, Charles Perine, Lord Remorin, Martin Rsler, and Rainer Vosseler Mark Thompson 2016, March 24 Iranian Cyber Attack on New York Dam Shows Future of War Retrieved. 2019/11/07  Caught in the Act: Running a Realistic Factory Honeypot to Capture Real Threats Retrieved. 2021/04/12 ","url":"https://documents.trendmicro.com/assets/white_papers/wp-caught-in-the-act-running-a-realistic-factory-honeypot-to-capture-real-threats.pdf"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0088","name":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component","category":"Host state and inventory","description":"Attributes of existing logon sessions and their association with accounts or hosts.","collection_focus":"Collect supported session inventory and correlate session IDs with authentication, logon and logoff events.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["session_id","account","host","session_type"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0078","name":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component","category":"Network and protocol telemetry","description":"Connection/flow summaries such as endpoints, duration, byte counts and transport.","collection_focus":"Collect Zeek conn.log, Suricata flow events or exporter equivalents, including observation point and sampling settings.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"},{"name":"AWS VPC Flow Logs","scope":"IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.","source_id":"flow"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["source_ip","destination_ip","destination_port","protocol","bytes_sent","bytes_received"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"},{"id":"flow","title":"AWS VPC Flow Logs","url":"https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."}],"detection":{"key":"ics/T0883","id":"T0883","name":"Internet Accessible Device","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0883","technique_page":"techniques/ics/T0883/","page":"detections/ics/T0883/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0796","name":"Detection of Internet Accessible Device","url":"https://attack.mitre.org/detectionstrategies/DET0796","stix_id":"x-mitre-detection-strategy--c7aea5e8-cd8b-4f79-be41-3a446cdde7b7","relationship_id":"relationship--b340e488-cae9-4c72-a704-ecb5ce7d9348","description":"","analytics":[{"id":"AN1928","name":"Analytic 1928","guidance":"Real-time monitoring identifies inbound connections to Industrial Control System (ICS) Windows application servers from internet-routed Internet Protocol (IP) addresses. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.","url":"https://attack.mitre.org/detectionstrategies/DET0796#AN1928","platforms":["Windows"],"tuning":[{"field":"OrganizationalIPSpace","description":"Documented internal/organizational IP address ranges."}],"log_sources":[{"component_id":"DC0088","component":"Logon Session Metadata","name":"WinEventLog:Security","channel":"Windows Security Event ID 4624/4625: inbound authentication attempt or successful session from internet-sourced Internet Protocol (IP) address to Industrial Control Systems (ICS) application port","platforms":["Windows"],"analytic_id":"AN1928","source_url":"https://attack.mitre.org/detectionstrategies/DET0796#AN1928","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"}]},{"id":"AN2222","name":"Analytic 2222","guidance":"Real-time monitoring identifies Industrial Control System (ICS) field device IPs receiving inbound connections from internet-sourced IP addresses on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.","url":"https://attack.mitre.org/detectionstrategies/DET0796#AN2222","platforms":["Embedded"],"tuning":[{"field":"OrganizationalIPSpace","description":"Documented internal/organizational IP address ranges."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"NSM:Connections","channel":"inbound connection to field device Internet Protocol (IP) address from source outside RFC1918/organizational IP space on Industrial Control System (ICS) protocol port","platforms":["Embedded"],"analytic_id":"AN2222","source_url":"https://attack.mitre.org/detectionstrategies/DET0796#AN2222","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2253","name":"Analytic 2253","guidance":"Real-time monitoring identifies an Industrial Control System (ICS) device or server accepting an inbound connection on its native protocol port from a source Internet Protocol (IP) address outside the organization's address space. Documented in Trend Micro's manufacturing honeypot research, with adversaries exploiting exposed Siemens S7, Omron Factory Interface Network Service (FINS), EtherNet/IP, and misconfigured Virtual Network Computing (VNC). OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.","url":"https://attack.mitre.org/detectionstrategies/DET0796#AN2253","platforms":["Network Devices"],"tuning":[{"field":"OrganizationalIPSpace","description":"Documented internal/organizational IP address ranges."}],"log_sources":[{"component_id":"DC0078","component":"Network Traffic Flow","name":"perimeter:firewall","channel":"inbound connection to Industrial Control Systems (ICS) device/server Internet Protocol (IP) address on ICS protocol port from source not in organizational IP space","platforms":["Network Devices"],"analytic_id":"AN2253","source_url":"https://attack.mitre.org/detectionstrategies/DET0796#AN2253","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0078/"}]},{"id":"AN2256","name":"Analytic 2256","guidance":"Real-time monitoring identifies Secure Shell (SSH), web application, or Industrial Control System (ICS) Application Programming Interface (API) authentication attempts on ICS Linux servers from internet-sourced Internet Protocol (IP) addresses. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity.","url":"https://attack.mitre.org/detectionstrategies/DET0796#AN2256","platforms":["Linux"],"tuning":[{"field":"OrganizationalIPSpace","description":"Documented internal/organizational IP address ranges."}],"log_sources":[{"component_id":"DC0088","component":"Logon Session Metadata","name":"syslog:auth","channel":"authentication attempt or success from internet-sourced Internet Protocol (IP) address not in organizational IP space","platforms":["Linux"],"analytic_id":"AN2256","source_url":"https://attack.mitre.org/detectionstrategies/DET0796#AN2256","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0088/"}]}]}],"telemetry_references":[{"id":"DC0088","name":"Logon Session Metadata","tag":"Logon Session Metadata","page":"telemetry/DC0088/","kind":"attack_component"},{"id":"DC0078","name":"Network Traffic Flow","tag":"Network Traffic Flow","page":"telemetry/DC0078/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S1157","name":"Fuxnet","url":"https://attack.mitre.org/software/S1157","kind":"malware","description":"[Fuxnet](https://attack.mitre.org/software/S1157) execution relied upon accessing Internet-accessible devices for initial access and deployment.(Citation: Claroty Fuxnet 2024)","relationship_id":"relationship--1b36c370-6e82-4c2f-936d-a6fe8aafc73d","references":[{"source_name":"Claroty Fuxnet 2024","description":"Team82. (2024, April 12). Unpacking the Blackjack Group's Fuxnet Malware. Retrieved September 11, 2024.","url":"https://claroty.com/team82/research/unpacking-the-blackjack-groups-fuxnet-malware"}]}],"actors":[{"id":"G1027","name":"CyberAv3ngers","url":"https://attack.mitre.org/groups/G1027","kind":"intrusion-set","description":"During the [2026 Iranian Water Campaign](https://attack.mitre.org/campaigns/C0065), [CyberAv3ngers](https://attack.mitre.org/groups/G1027) accessed internet accessible PLCs that were exposed through cellular gateways across multiple vendors including Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens.(Citation: CISA-AA26-097A)","relationship_id":"relationship--186bd80c-9e22-4e3d-9515-dbe5c89892fe","references":[{"source_name":"CISA-AA26-097A","description":"Cybersecurity and Infrastructure Security Agency. (2026, July 22). Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure. Retrieved September 26, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a"}]}],"mitigations":[{"id":"M0930","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M0930","kind":"course-of-action","description":"Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. Steps should be taken to periodically inventory internet accessible devices to determine if it differs from the expected.\n","relationship_id":"relationship--33215dfa-53d0-4bd7-a15d-cec9315c7c4d","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0822":"/ttp-simulation/techniques/ics/T0822/","T0819":"/ttp-simulation/techniques/ics/T0819/","T0883":"/ttp-simulation/techniques/ics/T0883/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0883","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0088","collector":"illustrative-lab-collector","observation":{"session_id":"lab-session-1","account":"LAB\\analyst","host":"lab-host-1","session_type":"interactive"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0078","collector":"illustrative-lab-collector","observation":{"source_ip":"192.0.2.10","destination_ip":"198.51.100.20","destination_port":443,"protocol":"tcp","bytes_sent":128,"bytes_received":512}}]}}