T0823 Graphical User Interface: Detection, Mitigation and Response

Graphical User Interface (T0823) is the attacker using the operator's own screen: once they reach an HMI desktop, they can open breakers and change setpoints with the same clicks a legitimate operator would use. MITRE ATT&CK for ICS lists it under Execution on Embedded, Windows, Linux and Network Devices platforms, and names remote access protocols such as RDP on Windows and VNC on Linux and Unix when physical access is not an option. ATT&CK is blunt about prevention: its only listed mitigation is M0816 Mitigation Limited or Not Effective, because once an adversary has a remote GUI they can abuse required HMI functions. That makes the defence about who can reach a GUI session and how fast an illegitimate one is noticed. This guide is for OT security engineers, SCADA administrators and SOC analysts. For the wider matrix see the MITRE ATT&CK for ICS Guide.

Key takeaways

• The HMI does what it was built to do. GUI abuse uses legitimate functions, so you cannot block the action without blocking operators; you control the session instead.
• Remote GUI access is the main path. RDP, VNC and vendor remote consoles to HMIs and engineering stations are where both recorded cases started.
• Access control does the preventive work. Restrict remote GUI sessions to a jump host, named accounts and multi-factor authentication, and remove default local administrator passwords.
• ATT&CK's analytics key on source, account and follow-on action. Alert on GUI sessions from outside approved management subnets or by accounts not on the operator list that then touch control elements.
• Response must be fast and coordinated. A hostile GUI session on an HMI can act on the process in seconds; operations need a pre-agreed way to cut it.

What T0823 covers

ATT&CK describes adversaries gaining access to a machine through a graphical user interface to enhance execution capabilities, using mouse and keyboard rather than only a command line, and executing programs and applications on the target. The technique overlaps with how access is obtained; those steps are separate techniques.

The Enterprise counterpart for the access protocol is covered in the T1021 Remote Services guide, which includes T1021.001 Remote Desktop Protocol.

Real cases recorded by ATT&CK

• 2015 Ukraine Electric Power Attack (C0028): ATT&CK records that Sandworm Team used HMI GUIs in the SCADA environment to open breakers. The E-ISAC and SANS analysis describes the attackers using existing remote administration tools on operator workstations together with VPN access from the IT network, being physically remote but logically local to the host, with operators locked out of their workstations. See the Sandworm Threat Actor Profile.
• 2025 Poland Wiper Attacks (C0063): ATT&CK records that the adversaries used a GUI over RDP to access a Mikronika HMI and execute commands, and used RDP to a domain controller to collect data and attempt destruction. CERT Polska's report states that the HMI access used a default local administrator password and that no password guessing was observed; HMIs with different local administrator credentials were not damaged.

Both cases are credential and remote access stories first. The GUI was the last step.

Prevention: control who reaches a GUI session

1. Inventory GUI access paths: list every RDP, VNC, vendor remote console and web HMI on OT hosts and embedded panels, and which zones can reach each. See the OT Asset Visibility Guide.
2. Route remote GUI through a jump host: allow RDP and VNC to HMIs only from a designated jump host in the OT DMZ, enforced by firewall rules. The E-ISAC and SANS analysis recommends routing remote access through a dedicated DMZ and disabling split tunnelling on VPNs.
3. Require multi-factor authentication at the boundary (M0932): the joint CISA, FBI, EPA and DOE primary mitigations call for phishing-resistant MFA and least privilege for OT remote access, and for disabling dormant accounts.
4. Remove default and shared local passwords: give each HMI a unique local administrator password, managed in a vault. The Polish case shows unique passwords limiting damage.
5. Restrict what the GUI can do: use HMI application roles so that view-only accounts cannot issue commands, and run kiosk or locked-down shells on operator stations where the vendor supports it.
6. Disable remote management where not required: the E-ISAC and SANS analysis recommends disabling remote management of field devices when it is not required; apply the same to embedded HMI panels with VNC servers.

Choosing a remote access pattern

See the OT Remote Access Guide and the OT Third-Party and Integrator Access Guide.

Detection: ATT&CK's analytics

ATT&CK v20 attaches four analytics to T0823. All use the same OT operational fidelity gate: alert only when the account, device or session violates the approved identity, source host, jump path or zone policy and is corroborated by access to a protected OT asset, execution, a configuration change or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning and documented remote access windows.

Microsoft documents logon type 10 (RemoteInteractive) as a logon through Terminal Services or Remote Desktop, and type 2 as an interactive logon at the machine; the event's Source Network Address field gives the connecting IP. A type 10 logon to an HMI from anything other than the jump host is a high-value alert on its own.

Making the analytics work

• Keep the approved lists current: the gate depends on an accurate operator list, jump host addresses and remote access windows.
• Record sessions: session recording on the jump host gives responders a replay of what was clicked.
• Watch the HMI application too: HMI audit trails of operator commands, matched against logged-on users and shift rosters, show actions a network sensor cannot.

Where identity fits

Shared operator logons, default local administrator accounts and vendor accounts with standing access are the identities behind T0823. Move to named accounts for engineers, unique vaulted local administrator passwords on each HMI, and time-bound vendor access. Shared shift accounts on operator stations are sometimes unavoidable for safety reasons; where they remain, restrict them to local console logon. See the OT and ICS Identity and Access Guide and NHIs in OT.

Safety-aware response

1. Agree the kill switch in advance: operations and security pre-agree who can terminate a remote session to an HMI and how (jump host, firewall rule, VPN account disable).
2. Cut the remote session, keep local control: end the remote path while operators keep local consoles running, rather than shutting the HMI down.
3. Check the process: compare breaker states, setpoints and modes with what operators expect, and reverse unauthorised changes under operations' direction.
4. Reset credentials: reset passwords for the accounts used, VPN and administrator accounts first, as the E-ISAC and SANS analysis recommends after a compromise.
5. Preserve evidence: keep jump host recordings, Windows Security and Sysmon logs, HMI audit trails and network captures. See the OT Incident Response Guide.

Metrics that show it is working

• Remote GUI paths outside the jump host: count of HMIs and engineering stations reachable by RDP or VNC from anywhere else. Target zero.
• Default or shared local administrator passwords: HMIs without a unique managed password. Target zero.
• Remote GUI sessions with MFA: share of remote sessions authenticated with MFA at the boundary.
• Time to terminate a hostile session: measured in exercises from alert to session cut.

Framework mapping

ATT&CK lists only M0816 for T0823 itself; the other mitigations in the table are general ATT&CK for ICS access controls, mapped here by NHI Mgmt Group to the access steps that precede GUI use (T0822, T0886, T0859).

Common failure patterns

• Default local administrator passwords on HMIs: the Polish attackers needed no guessing.
• Remote administration tools left installed on operator stations: the Ukraine attackers used tools already present.
• RDP open from the corporate network to the HMI: any compromised IT host becomes an operator console.
• Alerts without an operator list: without approved accounts and sources, every shift change looks like an anomaly and the analytics are turned off.
• No pre-agreed way to cut a session: responders waste minutes deciding who may act while the session continues.

Practitioner checklist

• Inventory RDP, VNC, vendor console and web HMI access on every OT host and panel.
• Allow remote GUI sessions to HMIs only from a hardened jump host with MFA and session recording.
• Set unique, vaulted local administrator passwords on every HMI and engineering station.
• Remove unused remote administration tools and VNC servers from operator stations and panels.
• Use HMI roles so view-only users cannot issue commands.
• Deploy ATT&CK's T0823 analytics with a current operator list, jump host list and remote access calendar.
• Agree and rehearse a remote session kill switch with operations.

Standards and references

• MITRE ATT&CK for ICS: Graphical User Interface (T0823)
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
• CERT Polska: Energy Sector Incident Report, 29 December 2025
• E-ISAC and SANS ICS: Analysis of the Cyber Attack on the Ukrainian Power Grid
• Microsoft: 4624(S) An account was successfully logged on

Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · HMI and SCADA Server Hardening Guide · OT Remote Access Guide · T1021 Remote Services