Skip to main content
OT Atlas
Search

Hunt playbook

Abnormal HMI Communication

Detect HMIs communicating with unusual peers, services or destinations.

IntermediateT0885T0884

Hypothesis

An HMI may be communicating outside its established peer set.

Why this hunt matters

An HMI is a trusted control-capable endpoint; its network behaviour is normally extremely predictable.

Scope

Assets: hmi, scada-server, plc

Protocols: modbus-tcp, s7comm, opc-ua

Data sources required

  • Network metadata
  • Endpoint logs
  • Proxy/DNS logs if applicable

Baseline needed first

  • Each HMI contacts a fixed set of controllers and servers, and nothing else

Hunt steps

  1. 01Build a per-HMI peer profile over a stable historical period
  2. 02Compare the current period and list new peers or services
  3. 03Investigate any external or enterprise-side destination
  4. 04Check endpoint logs for newly executed processes around the first occurrence

Indicators of interest

  • DNS or HTTP traffic from an HMI
  • New controller peers
  • Remote management services enabled
  • Traffic during unstaffed hours

Triage

  • Was software installed or updated?
  • Is the account used at the console expected?
  • Did the HMI issue any control action?

Likely false positives

  • Patch deployment
  • Vendor support sessions
  • Added process areas

Escalation

  • Internet-bound traffic
  • New peers combined with control writes

Containment options

  • Coordinate with operations — an HMI is required for safe operation; do not isolate casually

Validation

  • Peer allow-list defined
  • Unnecessary services removed

Why should I care?

Containment in OT is a joint decision. Isolating a device can be the safest action or the one that stops production — operations decides, security advises.