Hunt playbook
Historian Data Exfiltration
Detect abnormal bulk extraction of process data from historians or reporting systems.
IntermediateT0811T0882
Hypothesis
An account may be extracting significantly more process data than its role requires.
Why this hunt matters
Process data can reveal production capability, recipes and process design — and bulk export can also be a precursor to targeting.
Scope
Assets: historian, opc-server, scada-server
Protocols: opc-classic, opc-ua, mqtt, amqp
Data sources required
- Historian query and export logs
- Database audit logs
- Network volume metadata
- Authentication logs
Baseline needed first
- Typical report query volumes and known reporting accounts and schedules
Hunt steps
- 01Rank accounts and hosts by query volume and rows/bytes returned
- 02Compare against the historical profile per account
- 03Investigate exports outside scheduled reporting windows
- 04Check the destination of large outbound transfers from historian hosts
Indicators of interest
- Full-archive queries
- New accounts pulling large volumes
- Exports to unusual destinations
- Off-hours bulk queries
Triage
- Is there a project or audit requiring the data?
- Where did the data go?
- Does the account belong to a current employee or contractor?
Likely false positives
- Engineering studies and audits
- Data migration projects
- Analytics platform backfills
Escalation
- Data leaving the organisation
- Account of a departed user or contractor
Containment options
- Restrict the account; preserve query logs
Validation
- Least-privilege review of historian accounts
- Export alerting thresholds set
Why should I care?
Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.