<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-hmi-unauthorized-access
description: >-
  Detect and prevent unauthorized access to Human-Machine Interface systems through
  authentication monitoring, session analysis, USB device control, and behavioral
  anomaly detection on SCADA operator workstations.
domain: cybersecurity
subdomain: ot-ics-security
tags:
  - hmi
  - scada
  - ics
  - unauthorized-access
  - authentication
  - workstation-security
  - usb-control
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T0823", "T0856", "T0800"]
  nist-csf: ["PR.AC-1", "PR.AC-7", "DE.CM-3"]
  iec-62443: ["SR 1.1", "SR 1.2", "SR 1.7"]
  uuid: a1b2c3d4-1006-4000-a006-000000000006
---

# Detecting HMI Unauthorized Access

## Overview

HMI workstations are high-value targets — they provide direct control over physical
processes and often run on legacy Windows systems with weak authentication. Compromised
HMIs enable attackers to manipulate process displays (hiding attacks from operators),
issue control commands, and exfiltrate process data. Many HMIs use shared accounts,
lack MFA, and have USB ports exposed for maintenance.

Mode: `[MODE: BLUE]` for access monitoring; `[MODE: RED]` for HMI attack simulation.

## Prerequisites

| Requirement | Details |
|---|---|
| Windows Event Log forwarding from HMI workstations | Required |
| Sysmon deployed on HMI systems (configured for ICS) | Required |
| Network monitoring on HMI VLAN | Required |
| Application allowlisting solution (AppLocker, CarbonBlack) | Required |
| USB device control policy | Required |

## Key Concepts

### Windows Event Log Monitoring

```powershell
# Key events for HMI access detection
# 4624: Successful logon
# 4625: Failed logon
# 4648: Explicit credential logon
# 4672: Special privileges assigned
# 4688: New process creation (with command line)
# 4697: Service installation

# Query failed logons on HMI workstations
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 100 |
  Select-Object TimeCreated, @{N='Account';E={$_.Properties[5].Value}},
  @{N='Source';E={$_.Properties[19].Value}}

# Detect logons outside operations hours (assume 06:00-22:00)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} |
  Where-Object { $_.TimeCreated.Hour -lt 6 -or $_.TimeCreated.Hour -ge 22 }

# Detect RDP sessions to HMI (should be rare/controlled)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} |
  Where-Object { $_.Properties[8].Value -eq '10' }  # LogonType 10 = RemoteInteractive
```

### Sysmon for HMI Process Monitoring

```xml
<!-- Sysmon config for HMI workstations -->
<Sysmon schemaversion="4.90">
  <EventFiltering>
    <!-- Log all process creation on HMI -->
    <ProcessCreate onmatch="exclude" />
    <!-- Log network connections from HMI -->
    <NetworkConnect onmatch="include">
      <DestinationPort condition="is">502</DestinationPort>
      <DestinationPort condition="is">102</DestinationPort>
      <DestinationPort condition="is">44818</DestinationPort>
    </NetworkConnect>
    <!-- Log USB device connections -->
    <PnPDeviceConnected onmatch="exclude" />
  </EventFiltering>
</Sysmon>
```

### Sigma Rules for HMI Access

```yaml
title: Unauthorized RDP Access to HMI Workstation
id: b7e4c1f2-3a5d-4e9b-8c1d-2f6a7b8c9d0e
status: experimental
description: Detects RDP logon to HMI from non-operations source
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventID: 4624
    LogonType: 10
    TargetUserName|endswith: '-hmi'
  filter:
    IpAddress|startswith:
      - '10.2.0.'
      - '10.2.1.'
  condition: selection and not filter
falsepositives:
  - Authorized remote maintenance via jump host
level: high
tags:
  - attack.t0823
  - attack.initial_access
```

```yaml
title: USB Device Connected to HMI Workstation
id: c8f5d2a3-4b6e-5f0c-9d2e-3a7b8c9d1e2f
status: experimental
description: Detects USB mass storage device connection on HMI
logsource:
  category: pnp_device_connected
  product: windows
detection:
  selection:
    ClassName: 'DiskDrive'
  condition: selection
falsepositives:
  - Authorized USB during scheduled maintenance window
level: high
tags:
  - attack.t0847
  - attack.initial_access
```

### Network-Based HMI Monitoring

```bash
# Monitor HMI network connections with Zeek
zeek -r hmi_traffic.pcap local

# Detect HMI connecting to unexpected destinations
cat conn.log | zeek-cut id.orig_h id.resp_h id.resp_p | \
  grep "10.2.0.50" | \  # HMI IP
  grep -v -E "^10\.2\.(0|1)\." | \  # Filter expected OT subnets
  sort -u

# Suricata: detect HMI reaching internet
cat << 'EOF'
alert tcp 10.2.0.0/24 any -> !10.0.0.0/8 any ( \
  msg:"HMI - Outbound Internet Connection Detected"; \
  flow:established,to_server; \
  sid:4004001; rev:1; \
  metadata:mitre_attack_technique T0885;)
EOF
```

## Workflow

### Step 1: Inventory HMI Systems

```bash
# Enumerate HMI workstations and their access profiles
nmap -sV -p 3389,5900,502,102,80,443 10.2.0.0/24 -oN hmi_inventory.txt
```

### Step 2: Deploy Monitoring

```powershell
# Install Sysmon with ICS-tuned config
sysmon64.exe -accepteula -i hmi_sysmon_config.xml
# Configure Windows Event Log forwarding to SIEM
wecutil qc  # Quick config for event collection
```

### Step 3: Baseline and Alert

```bash
# Profile normal HMI access patterns
# Build allowlist of authorized users and source IPs
# Deploy Sigma rules to SIEM
```

## Verification

- [ ] Windows Event Logs forwarded from all HMI workstations
- [ ] Sysmon deployed with ICS-specific configuration
- [ ] RDP/VNC access monitored and restricted to jump host
- [ ] USB device insertion alerts operational
- [ ] Failed logon threshold alerting configured
- [ ] After-hours access detection rules deployed
- [ ] Application allowlisting active on HMI systems

## Detection Opportunities

- RDP from non-jump-host source → unauthorized remote access
- Multiple failed logons followed by success → brute force or credential stuffing
- USB mass storage connection → potential malware delivery vector
- New process execution not in allowlist → unauthorized software
- HMI connecting to internet → C2 or exfiltration from compromised workstation
- After-hours logon activity → insider threat or remote attacker

## References

- MITRE ATT&CK for ICS: T0823 (Graphical User Interface), T0856 (Spearphishing Attachment)
- IEC 62443-3-3 SR 1.1: Human User Identification and Authentication
- NIST SP 800-82 Rev 3 §6.2.4: HMI Security
- CISA: Securing HMI Environments
