<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting HMI Unauthorized Access — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-hmi-unauthorized-access.

## Tools

### `sysmon`

Windows system monitoring for process and network activity on HMI workstations.

**Usage:**
```powershell
sysmon64.exe -accepteula -i config.xml
```

**Key Event IDs:**
  - `1`: Process creation (with command line)
  - `3`: Network connection
  - `25`: PnP device connected (USB)
  - `7`: Image loaded (DLL)

---

### `wevtutil`

Windows event log query and export utility.

**Usage:**
```powershell
wevtutil qe Security /c:100 /f:text
```

**Key Flags:**
  - `qe`: query events
  - `epl`: export log to EVTX file
  - `/c`: count of events to return

---

### `nmap`

Service discovery on HMI workstations.

**Usage:**
```bash
nmap -sV -p 3389,5900,502,80,443 <target>
```

---

### `tshark`

Network traffic analysis for HMI communication patterns.

**Usage:**
```bash
tshark -r <pcap> -Y "ip.src == <hmi_ip>"
```

---

## Integration Notes

- Deploy Sysmon with ICS-specific configuration (log PLC protocol connections)
- Forward all Windows Event Logs to SIEM via Windows Event Forwarding (WEF)
- USB device monitoring requires Sysmon PnP event support (v13+)

## See Also

- Parent skill: [OT/ICS Security](../../../SKILL.md)
- IEC 62443-3-3 SR 1.1: Human User Identification and Authentication
