T0882 Theft of Operational Information
ICSAdversaries may steal operational information on a production environment as a direct mission outcome for personal gain or to inform future operations. This information may include design documents, schedules, rotational data, or similar artifacts that provide insight on operations. In the Bowman Dam incident, adversaries probed systems for operational data.
01
platforms
Platforms this applies to.
None
02
mitigations
ATT&CK mitigations that reduce this.
03
software (4)
Malware and tools associated with this.
04
campaigns (1)
Campaigns that use this.
05
source
Where this definition is published.