Sandworm Team blocked command messages by using malicious firmware to render communication devices inoperable. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Human-Machine Interface|T0823|Graphical User Interface|In the Ukraine 2015 Incident,

Sandworm Team utilized HMI GUIs in the SCADA environment to open breakers. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Control Server,Data Historian,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server|T0807|Command-Line Interface|

Sandworm Team uses the MS-SQL server xp_cmdshell command, and PowerShell to execute commands. (Citation: Dragos October 2018)|