An HMI screen shows an attacker the process layout, setpoints, alarms and device names in one picture, which is why screenshots of OT displays are a reconnaissance prize. MITRE ATT&CK for ICS tracks this as T0852 Screen Capture under the Collection tactic (TA0100), on Embedded, Windows and Linux platforms. It mirrors Enterprise T1113; the ICS entry matters because of what is on the screen and because ATT&CK itself rates prevention as limited. This guide is for OT security engineers and SOC analysts: where screen capture happens, how to detect it on HMIs and operator workstations, and how to limit the damage. It is deliberately short, because most of the control set is the same as for any remote access or endpoint monitoring programme.
Key takeaways
- The value is in what the screen reveals. ATT&CK notes that displays can expose process, device, reporting and alarm data, layout and schematics, and that an HMI is particularly rich.
- Prevention is officially limited. ATT&CK maps T0852 to M0816 Mitigation Limited or Not Effective, because blocking capture APIs may break critical applications.
- Detection is the main control. ATT&CK's DET0751 looks for screenshot tools run by unusual users, capture API use by unapproved processes and VNC or web capture of embedded HMI panels from unapproved sources.
- Espionage groups do this. ATT&CK lists ALLANITE collecting and distributing screenshots of HMIs, APT33 backdoors with screenshot capability and the 2025 Poland wiper attacks using nircmd for screenshots.
- Remote access is the usual route. Controlling who can view HMI sessions remotely removes most of the exposure.
What T0852 covers in OT
ATT&CK describes adversaries taking screenshots of workstations, HMIs or other devices that display process, device, reporting, alarm or related data. Those displays may reveal the ICS process, layout, control and schematics, and analysis of them may give the adversary an understanding of intended operations and the interactions between critical devices. In practice that makes screen capture a preparation step: it shortens the time an attacker needs to understand a process before attempting to affect it.
| Capture route | Where it applies | What to watch |
|---|---|---|
| Screenshot utility or malware on a Windows HMI or operator workstation | PC-based HMIs, SCADA clients, engineering workstations | Processes loading capture libraries and writing image files |
| Screenshot utility on a Linux HMI | Linux-based HMI and SCADA clients | Execution of tools such as scrot, import or xwd by unusual accounts |
| Remote viewing of embedded panels | Panel HMIs with built-in web servers or VNC | Connections from sources outside the operator workstation list |
| Remote support sessions | Vendor and integrator access to HMIs | Session recording settings, who joined, from where |
Procedure examples
| Example | What ATT&CK states | Defensive lesson |
|---|---|---|
| ALLANITE (G1000) | Identified collecting and distributing screenshots of ICS systems such as HMIs. ATT&CK describes the group as suspected Russian cyber espionage targeting electric utilities in the United States and United Kingdom, maintaining presence to understand industrial processes, and not known to have carried out disruptive attacks. | Espionage on OT often looks quiet; screen capture is one of its few visible actions on the HMI. |
| APT33 (G0064) | Uses backdoors capable of capturing screenshots once installed. | General purpose backdoors bring capture capability with them; endpoint detection on HMIs matters. |
| 2025 Poland Wiper Attacks (C0063) | Adversaries used the nircmd utility to capture screenshots of systems. CERT Polska's report describes destructive attacks on 29 December 2025 against grid connection substations of renewable farms, a combined heat and power plant and a manufacturer. | Reconnaissance tooling preceded destructive action; capture alerts are an early warning. |
Detection: ATT&CK's analytics for screen capture
ATT&CK v20 attaches detection strategy DET0751 to T0852. Its fidelity gate is different from execution techniques: do not alert on novelty alone; alert when the source role is not authorised and behaviour deviates from the operational baseline, and suppress normal SCADA, HMI and historian activity, commissioning, inventory and backup.
| Analytic | Platform | Signal | Log source named by ATT&CK |
|---|---|---|---|
| AN1883 | Linux | Execution of screenshot utilities (scrot, import, xwd) on a Linux HMI by a user ID not in the approved operator list | auditd execve records |
| AN2250 | Embedded | VNC connections or screen capture HTTP requests to an embedded HMI panel from sources not in the approved operator workstation list | Network content inspection |
| AN2274 | Windows | A process that is not a recognised ICS application or approved remote support tool loading GDI32.dll or User32.dll on an HMI host, followed by an image file write | Sysmon Event ID 7 (image loaded) and 11 (file create) |
Image load events for common graphics libraries are noisy on Windows, so the useful rule is the combination: an unapproved process on an HMI-classified host, the library load and an image file written shortly afterwards.
Metrics that show it is working
- HMI telemetry coverage: share of HMI and operator hosts sending process and file events to the SOC.
- Remote viewing control: share of embedded panels whose VNC or web interface is reachable only from approved sources.
- Capture alerts: number of screen capture alerts per month and share closed as authorised activity, which should fall as baselines improve.
- Remote session accountability: share of vendor sessions to HMIs that are brokered, named and logged.
Reducing exposure when prevention is limited
- Restrict remote viewing. Disable VNC and web viewing on panel HMIs that do not need it; where needed, allow it only from the operator zone or a brokered jump host. See the HMI and SCADA Server Hardening Guide.
- Allowlist applications on HMIs. If only the HMI runtime and approved tools can execute, capture utilities and most backdoors cannot run. See the Application Allowlisting Guide.
- Broker vendor access. Route remote support through a jump host with individual accounts and session logging. See the OT remote access and historian rollout playbook.
- Watch outbound paths. Screenshots are only useful once exfiltrated; OT zones should have no direct internet egress, and image transfers out of the OT network deserve review.
- Treat display content as sensitive. Screenshots and exported HMI graphics in tickets, emails or vendor portals reveal the same information; handle them under the site's information classification.
Where identity fits
Most legitimate remote viewing of HMIs is done by vendors and integrators. Shared support accounts and permanent remote sessions make capture by an outsider indistinguishable from support work. Give each support engineer an individual account, time-bound access and a logged session.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| ATT&CK for ICS mitigation | M0816 Mitigation Limited or Not Effective | ATT&CK's statement that preventive controls are limited |
| ATT&CK Enterprise | T1113 Screen Capture | Enterprise counterpart for IT hosts |
| NIST SP 800-53 Rev 5 | AC-17 Remote Access; CM-7 Least Functionality; SI-4 System Monitoring; SC-7 Boundary Protection | Control remote viewing, remove unneeded capture tools, monitor, restrict egress |
| NIST CSF 2.0 | DE.CM-09; DE.CM-01 | Monitoring hosts and networks for adverse events |
Common failure patterns
- VNC or web viewing left enabled on panel HMIs and reachable from the wider plant network.
- No endpoint telemetry from HMIs, so capture tools run unseen.
- Shared vendor accounts with standing remote access to operator screens.
- HMI screenshots circulated freely in tickets and email, giving away the same information.
Practitioner checklist
- Inventory HMIs and panels with VNC or web viewing enabled.
- Restrict remote viewing to approved sources or a brokered jump host.
- Enforce application allowlisting on PC-based HMIs.
- Collect process and file events from HMI hosts and apply DET0751 style rules.
- Give vendors individual, time-bound, logged access.
- Block direct internet egress from OT zones.
Standards and references
- MITRE ATT&CK: Screen Capture (T0852)
- MITRE ATT&CK: Screen Capture (T1113)
- MITRE ATT&CK: ALLANITE (G1000)
- MITRE ATT&CK: Mitigation Limited or Not Effective (M0816)
- CERT Polska: Energy Sector Incident Report, 2025
- NIST: SP 800-53 Rev 5, Security and Privacy Controls
Related NHI Mgmt Group resources: HMI and SCADA Server Hardening Guide · OT remote access and historian rollout playbook · Engineering Workstation Security Guide · OT Security Guide