Adversaries may attempt to perform screen capture of devices in the control system environment. Screenshots may be taken of workstations, HMIs, or other devices that display environment-relevant process, device, reporting, alarm, or related data. These device displays may reveal information regarding the ICS process, layout, control, and related schematics. In particular, an HMI can provide a lot of important industrial process information. [1] Analysis of screen captures may provide the adversary with an understanding of intended operations and interactions between critical devices.
| ID | Name | Description |
|---|---|---|
| C0063 | 2025 Poland Wiper Attacks |
During the 2025 Poland Wiper Attacks, the adversaries used the |
| G1000 | ALLANITE |
ALLANITE has been identified to collect and distribute screenshots of ICS systems such as HMIs. [3] [1] |
| G0064 | APT33 |
APT33 utilize backdoors capable of capturing screenshots once installed on a system. [4][5] |
| ID | Asset |
|---|---|
| A0002 | Human-Machine Interface (HMI) |
| A0012 | Jump Host |
| A0001 | Workstation |
| ID | Mitigation | Description |
|---|---|---|
| M0816 | Mitigation Limited or Not Effective |
Preventing screen capture on a device may require disabling various system calls supported by the operating systems (e.g., Microsoft Windows.Graphics.Capture APIs), however, these may be needed for other critical applications. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0751 | Detection of Screen Capture | AN1883 |
Real-time monitoring identifies execution of screenshot utilities (scrot, import, xwd) on an Industrial Control System (ICS) Linux Human-Machine Interface (HMI), from a User Identifier (UID) that does not normally perform display operations. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
| AN2250 |
Real-time monitoring identifies Hypertext Transfer Protocol (HTTP) requests to an embedded Human-Machine Interface (HMI) panel's built-in web server capturing screen images, or Virtual Network Computing (VNC) connections to embedded HMI panels, from source Internet Protocol (IP) addresses not in the approved operator workstation list. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |
||
| AN2274 |
Real-time monitoring identifies a process invoking screen capture Application Programming Interfaces (APIs) targeting an Human-Machine Interface (HMI) or operator workstation window, where the calling process is not a recognized Industrial Control System (ICS) vendor application or approved remote support tool, immediately followed by an image file write. OT operational-fidelity gate: Do not alert on novelty, scan/read volume, or enumeration alone. Alert when the source role is not authorized for discovery/polling and the target scope, address/tag range, protocol, or rate deviates from the established operational baseline. Suppress normal SCADA/HMI/historian polling, commissioning, asset inventory, backup, diagnostics, and approved engineering activity. |