A0001: Workstation
Workstations are devices used by human operators or engineers to perform various configuration, programming, maintenance, diagnostic, or operational tasks. Workstations typically utilize standard desktop or laptop hardware and operating systems (e.g., MS Windows), but run dedicated control system applications or diagnostic/management software to support interfacing with the control servers or field devices. Some workstations have a fixed location within the network architecture, while others are transient devices that are directly connected to various field devices to support local management activities.
Security context for executives and security teams
An ICS workstation is often the human bridge into control operations: engineers and operators use it for configuration, programming, diagnostics, maintenance, and operational tasks. Because these systems may be fixed in the OT network or temporarily connected to field devices, compromise can create risk beyond normal endpoint loss, including loss of visibility, unauthorized changes, disrupted maintenance, or a path toward devices that affect physical processes.
Executive priority
Treat ICS workstations as high-value operational access points, not ordinary desktops. Leaders should ask whether these Windows and Linux systems are inventoried, segmented, monitored, governed for removable media and remote access, and included in incident response and recovery plans. The relationship context shows they are targeted by techniques involving valid accounts, command line and GUI interaction, discovery, sniffing, supply chain and removable media exposure, exploitation of public-facing applications, and destructive or disruptive actions such as data destruction and restart/shutdown. That makes them important for business continuity, audit evidence, OT access governance, and cyber-physical risk management.
Technical view
SOC, OT security, and IR teams should validate endpoint and network visibility around both fixed and transient workstations. ATT&CK provides no official detection text for this asset, so coverage should be built from the related techniques: command-line and scripting activity, GUI/remote interaction, account use, network enumeration, port/broadcast/multicast discovery, packet capture behavior, removable media use, suspicious file masquerading, screen capture, rootkit-like hiding behavior, public-facing service exposure, wireless access paths, and abnormal restart/shutdown or data destruction events. Because these systems may run dedicated control-system and vendor tools, detections need local baselines to distinguish approved engineering activity from suspicious use.
Likely telemetry
- Asset inventory identifying ICS workstations, operating system, ownership, location, and whether fixed or transient
- Endpoint process creation, command-line, scripting, service, driver, file creation/deletion, and restart/shutdown events
- Authentication and authorization logs for operator, engineer, service, local, remote, and default/legacy accounts
- Remote access and GUI session logs where applicable, including administrative access to workstation interfaces
- Network flow, DNS, connection, and protocol telemetry for workstation-to-server, workstation-to-field-device, and peer communications
Detection direction
- Start with authoritative baselines: which users, tools, scripts, protocols, and destinations are normal for each engineering or operator workstation.
- Correlate identity events with endpoint and network activity; valid account use may look legitimate unless paired with unusual timing, source, privilege, destination, or tool behavior.
- Tune command-line, scripting, GUI, and native API monitoring to account for approved maintenance workflows while flagging rare interpreters, unexpected administrative utilities, masqueraded files, and non-native tools.
- Monitor discovery behavior from workstations, including netstat-like enumeration, port scans, broadcast discovery, multicast discovery, and unusual connections to field devices or control servers.
- Pay special attention to transient workstations and removable media, because the asset description explicitly includes devices directly connected to field devices for local management.
Mitigation priorities
- Maintain a current ICS workstation inventory, including fixed and transient devices, installed control-system applications, network zones, and authorized users.
- Limit workstation privileges and use governed accounts for operator, engineering, service, and remote access functions; review default or shared credential exposure where applicable.
- Segment workstation communications to required control servers, field devices, and management services; restrict unnecessary internet-facing, wireless, and peer-to-peer exposure.
- Control removable media use with policy, technical restrictions, scanning, and logging appropriate for OT operational constraints.
- Harden Windows and Linux workstation configurations, including unnecessary service reduction, patch and vulnerability prioritization for exposed applications, and protection of security controls from tampering.
Additional notes and limits
This is an ATT&CK for ICS asset object, not a technique. Its value is in showing where many ICS behaviors converge: human-operated systems that interface with control servers and field devices. The supplied relationships indicate a broad set of techniques that can target workstations, including access, execution, discovery, evasion, collection, and disruption-oriented behaviors. Defensive planning should therefore use the asset as a coverage anchor for identity, endpoint, network, removable media, exposure, and recovery controls.
MITRE did not provide official detection guidance or tactics for this asset object. The related technique descriptions are summarized relationship context, not proof of activity in any specific environment. Local architecture, approved engineering workflows, vendor tooling, safety requirements, and available telemetry are required to determine actual risk, detection fidelity, and mitigation sequencing.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Workstation
Workstations are devices used by human operators or engineers to perform various configuration, programming, maintenance, diagnostic, or operational tasks. Workstations typically utilize standard desktop or laptop hardware and operating systems (e.g., MS Windows), but run dedicated control system applications or diagnostic/management software to support interfacing with the control servers or field devices. Some workstations have a fixed location within the network architecture, while others are transient devices that are directly connected to various field devices to support local management activities.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.