メニュー
Adversaries may steal operational information on a production environment as a direct mission outcome for personal gain or to inform future operations.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill t0882-theft-of-operational-informationコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SOC 職業分類に基づく
SKILL.md を表示中
| name | T0882_theft-of-operational-information |
| description | Adversaries may steal operational information on a production environment as a direct mission outcome for personal gain or to inform future operations. |
| category | business-logic |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","ics","t0882","impact"] |
| technique_id | T0882 |
| tactic | impact |
| all_tactics |
| ["impact"] |
| platforms | ["ICS"] |
| mitre_url | https://attack.mitre.org/techniques/T0882 |
| tech_stack | ["ics"] |
| cwe_ids | ["CWE-400"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Adversaries may steal operational information on a production environment as a direct mission outcome for personal gain or to inform future operations. This information may include design documents, schedules, rotational data, or similar artifacts that provide insight on operations. In the Bowman Dam incident, adversaries probed systems for operational data.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Theft of Operational Information by examining operational technology systems and network architecture.
Review whether mitigations for T0882 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
Protect files stored locally with proper permissions to limit opportunities for adversaries to interact and collect information from databases.
Example mitigations could include minimizing its distribution/storage or obfuscating the information (e.g., facility coverterms, codenames). In many cases this information may be necessary to support critical engineering, maintenance, or operational functions, therefore, it may not be feasible to implement.
Apply DLP to protect the confidentiality of information related to operational processes, facility locations, device configurations, programs, or databases that may have information that can be used to infer organizational trade-secrets, recipes, and other intellectual property (IP).
Encrypt any operational data with strong confidentiality requirements, including organizational trade-secrets, recipes, and other intellectual property (IP).
| Finding | Severity | Impact |
|---|---|---|
| Theft of Operational Information technique applicable | Low | Impact |
| CWE ID | Title |
|---|---|
| CWE-400 | Uncontrolled Resource Consumption |
