Edit Technique: Technique/T0823

You do not have permission to edit this page, for the following reason:

The action you have requested is limited to users in one of the groups: Administrators, confirmed.

Name
Tactic *	Initial Access Execution Persistence Privilege Escalation Evasion Discovery Lateral Movement Collection Command and Control Inhibit Response Function Impair Process Control Impact
Data Sources A list of data sources that may be used to detect this technique
Technical Description * A detailed technical description of this technique	Adversaries may attempt to gain access to a machine via a Graphical User Interface (GUI) to enhance execution capabilities. Access to a GUI allows a user to interact with a computer in a more visual manner than a CLI. A GUI allows users to move a cursor and click on interface objects, with a mouse and keyboard as the main input devices, as opposed to just using the keyboard. If physical access is not an option, then access might be possible via protocols such as VNC on Linux-based and Unix-based operating systems, and RDP on Windows operating systems. An adversary can use this access to execute programs and applications on the target machine. In the Oldsmar water treatment attack, adversaries utilized the operator HMI interface through the graphical user interface. This action led to immediate operator detection as they were able to see the adversary making changes on their screen.[[CiteRef::Oldsmar Water - Sheriff Conf - youtube]]
External Contributors
Assets

Mitigations

Mitigation
Description	Once an adversary has access to a remote GUI they can abuse system features, such as required HMI functions.

Navigation menu