T0882 Theft of Operational Information — Attack Simulation

proposed-operational-document-access-audit collection page — Enable document-read/download audit on the lab repository; retain document ID, identity and result without storing document bodies.

Providers and collection configuration

• Application audit logs: First-party service events and request/result fields; schema is application-specific.
• OpenTelemetry-compatible log pipelines: Transport and normalization of emitted records; do not create missing audit instrumentation.

• Enable the application audit category or instrument the owned lab application at the authorization/action boundary.
• Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.
• Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart.

Required normalized fields: document_id, actor, action, result.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "proposed-operational-document-access-audit",
  "collector": "illustrative-lab-collector",
  "observation": {
    "document_id": "lab-procedure-1",
    "actor": "lab-reader",
    "action": "download",
    "result": "success"
  }
}

Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.

proposed-egress-and-transfer-records collection page — Collect outbound flow/proxy/application transfer metadata with direction and bytes; distinguish application exports from network delivery.

Providers and collection configuration

• Zeek: Connection and protocol metadata from traffic visible to the sensor.
• Suricata EVE: Configured flow, alert, DNS, HTTP, TLS and protocol records.
• AWS VPC Flow Logs: IP traffic metadata alternative; no packet payload or DNS answer history, and some traffic is not logged.

• Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.
• Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.
• Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection.

Required normalized fields: source, destination, direction, bytes_sent.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "proposed-egress-and-transfer-records",
  "collector": "illustrative-lab-collector",
  "observation": {
    "source": "192.0.2.10",
    "destination": "198.51.100.20",
    "direction": "outbound",
    "bytes_sent": 128
  }
}

Visibility limits: Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.

MITRE detection strategy

No exact-tagged Sigma source rule was imported. This does not establish that the technique is undetectable; the MITRE guidance and collection requirements remain relevant.

• S0038 Duqu — malware.

  Duqu's purpose is to gather intelligence data and assets from entities such as industrial infrastructure and system manufacturers, amongst others not in the industrial sector, in order to more easily conduct a future attack against another third party.[Symantec W32.Duqu]

  Exact relationship: relationship--792324b4-064a-430c-8ffc-7f7acd537778
• S0143 Flame — malware.

  Flame can collect AutoCAD design data and visio diagrams as well as other documents that may contain operational information. [Kevin Savage and Branko Spasojevic]

  Exact relationship: relationship--79d05cb2-ded0-4847-b52e-af7af421f303
• S0496 REvil — malware.

  REvil sends exfiltrated data from the victims system using HTTPS POST messages sent to the C2 system. [McAfee Labs October 2019] [SecureWorks September 2019]

  Exact relationship: relationship--6ed07095-c23a-4676-807f-a544deaeb274
• S1000 ACAD/Medre.A — malware.

  ACAD/Medre.A can collect AutoCad files with drawings. These drawings may contain operational information. [ESET]
  

  Exact relationship: relationship--228b9a13-0545-4ecf-99ff-be02addaf7fe

• M0803 Data Loss Prevention

  Apply DLP to protect the confidentiality of information related to operational processes, facility locations, device configurations, programs, or databases that may have information that can be used to infer organizational trade-secrets, recipes, and other intellectual property (IP).
  

• M0809 Operational Information Confidentiality

  Example mitigations could include minimizing its distribution/storage or obfuscating the information (e.g., facility coverterms, codenames). In many cases this information may be necessary to support critical engineering, maintenance, or operational functions, therefore, it may not be feasible to implement.
  

• M0922 Restrict File and Directory Permissions

  Protect files stored locally with proper permissions to limit opportunities for adversaries to interact and collect information from databases. [Keith Stouffer May 2015] [National Institute of Standards and Technology April 2013]
  

• M0941 Encrypt Sensitive Information

  Encrypt any operational data with strong confidentiality requirements, including organizational trade-secrets, recipes, and other intellectual property (IP).