T0813 Denial of Control: Detection, Mitigation and Response

Denial of Control (T0813) is the moment operators press a button on the HMI and nothing happens at the plant, while the process keeps running in whatever state it was left. MITRE ATT&CK for ICS files it under the Impact tactic and defines it as temporarily preventing operators and engineers from interacting with process controls. Because it is an outcome rather than a single method, there is no one signature for it: ATT&CK v20 states plainly that no standard detection method currently exists. This guide is for OT security engineers, control engineers and incident responders. It covers how denial of control has happened in real incidents, the precursor techniques you can detect, the three mitigations ATT&CK lists, and how to keep or regain control safely. For the wider matrix see the MITRE ATT&CK for ICS Guide.

Key takeaways

• It is an effect, not a tool. Locked-out PLCs, blocked serial channels, bricked gateways and an investigator shut out of a network all count, so defence means detecting the techniques that lead to it.
• Temporary is the defining word. T0813 covers a temporary loss; a sustained loss is Loss of Control (T0827), and changing what the controls do is Manipulation of Control (T0831).
• The process may keep running in an unsafe state. ATT&CK notes the process can still operate during the loss, but not necessarily in a desired state, so the safety layer and manual operation carry the risk.
• ATT&CK lists three mitigations, all about resilience. Out-of-band communications (M0810), redundancy of service (M0811) and data backup with gold images (M0953).
• Recent cases were mostly simple. In the 2026 US water utility attacks, internet-facing PLCs had their IP addresses and passwords changed. Exposure and default credentials, not exotic malware, did the damage.

What T0813 covers and how it differs from nearby techniques

ATT&CK for ICS describes an adversary attempting to deny process control access to cause a temporary loss of communication with the control device, or to prevent operator adjustment of process controls. The technique has no platform listed (ATT&CK shows "None") because it describes the result, and the means can be anything from a network flood to a changed controller password. The cited example in the technique description is the 2017 Dallas siren incident, where operators could not disable false alarms from the Office of Emergency Management headquarters.

In practice one incident often shows several of these at once. Plan detection around the means (T0814, T1691 Block Operational Technology Message, T1695 Block Communications, T1693 Modify Firmware, T0859 Valid Accounts) and plan response around the effect. The tactic context is in the ATT&CK for ICS Inhibit Response Function Tactic Guide.

Real cases recorded by ATT&CK

ATT&CK v20 lists one piece of software and three campaigns as procedure examples for T0813.

The E-ISAC and SANS analysis of the Ukraine attack called the serial-to-ethernet firmware overwrite "blowing the bridges": once the gateways were bricked, remote commands could not restore substations even after operator workstations were recovered. For the actor background see the Sandworm Threat Actor Profile.

Tenable's summary of the 2026 water attacks, citing the FBI and EPA public service announcement of 30 July 2026, records loss of monitoring and control at affected utilities, with one Minnesota city restoring its plant in about two hours and another keeping service running through manual procedures. The FBI and EPA did not attribute the activity. See the Water and Wastewater Cybersecurity Guide.

Detecting the paths to denial of control

ATT&CK's detection strategy for T0813 contains a single analytic that reads "No standard detection method currently exists for this technique." That is honest: you detect the outcome through operations, and the cause through the precursor techniques.

Operational signals the SOC should receive

• Command failure alarms: most SCADA systems raise a communication failure or command timeout alarm. Forward these to the OT SOC so security sees them, not just the control room.
• Operator reports: a short reporting route from the control room ("I cannot operate X") to the security on-call turns operators into the best sensor for T0813.
• Change correlation: compare every command failure against the change and maintenance calendar. A failure with no matching work order is worth a call.

For sensor placement see the OT Network Security Monitoring Guide and for running this in a SOC the OT Security Operations Centre Guide.

Mitigations: the three ATT&CK lists and what supports them

1. Out-of-band communications channel (M0810): ATT&CK advises redundant, out-of-band communication to support monitoring and control, using diverse systems and technologies to minimise common failure modes. Examples include a separate radio or cellular path to remote sites, used only when the primary path fails and secured with its own authentication.
2. Redundancy of service (M0811): hot standbys in diverse locations, and at the network layer protocols such as the Parallel Redundancy Protocol, keep control available when one path or server is lost. Redundancy does not help if the same credential or flaw takes out both copies, so diversify where you can.
3. Data backup (M0953): ATT&CK calls for hardened backups kept separate from the corporate network and gold-copy images and configurations for key systems, so recovery from loss of control, view or availability is quick. The Ukraine bridges and the water utility password changes are both recoverable faster with an offline copy of device configuration and firmware.

The mitigations above limit impact. The controls that stop the precursors are in the joint CISA, FBI, EPA and DOE primary mitigations for OT: remove OT connections to the public internet, change default passwords and use strong unique passwords, secure remote access, segment IT and OT networks, and practise and maintain the ability to operate OT systems manually.

Choosing what to fund first

Small utilities with a handful of sites get most value from the first two rows. See the OT Backup, Recovery and Golden Image Guide.

Where identity fits

Several T0813 cases turn on credentials: default or shared passwords on controllers and gateways, and an attacker able to change them and lock the owner out. Treat controller and gateway passwords as managed non-human credentials: unique per device, stored in a vault, rotated after any vendor visit, and with an offline record so the owner can recover access. See NHIs in OT and the OT and ICS Identity and Access Guide.

Safety-aware response

1. Protect the process first: when control is lost, the control room decides whether to move to manual operation or a safe state. Security supports that decision; it does not make it.
2. Confirm the safety layer: check that the safety instrumented system is healthy and has not been touched. See the Safety Instrumented Systems Security Guide.
3. Find the break point: establish whether the failure is at the HMI, the network, a gateway or the controller. Communication statistics and protocol sensor data usually show where messages stop.
4. Contain the access path: close the internet or cellular path, disable the account or remote session used, and block the source at the zone boundary.
5. Preserve evidence: capture controller configuration as found, network captures and gateway logs before restoring, where operations allow.
6. Restore from known-good copies: reload device configuration and firmware from offline backups, set new unique credentials, and verify control with operations before returning to automatic. Plymouth's choice in 2026 to disconnect cellular equipment while reconfiguring is a reasonable model.

The full process is in the OT Incident Response Guide.

Metrics that show it is working

• Internet-reachable controllers: count of PLCs, RTUs and gateways reachable from the internet or public cellular space. Target zero.
• Backup coverage: share of controllers and gateways with a current offline copy of configuration and firmware.
• Manual operation drills: number of sites that rehearsed manual operation in the last twelve months, and time to stable manual control.
• Unmatched command failures: command failure or communication loss events with no matching work order, and the share investigated within a shift.
• Default credentials remaining: OT devices still using vendor default passwords. Target zero outside documented exceptions.

Framework mapping

NIST SP 800-82 Rev 3 is the tailoring reference for these controls in OT; see the NIST SP 800-82 OT Security Guide. For zone design see the IEC 62443 Guide.

Common failure patterns

• Controllers on the open internet "for convenience": the 2026 water attacks needed nothing more than reachable PLCs behind cellular gateways.
• No offline copy of device settings: when an attacker changes a controller's IP address and password, the owner needs a record of the right values and a way back in.
• Redundancy with shared weaknesses: two servers with the same credentials or the same reachable flaw fail together.
• Command failure alarms that stay in the control room: security never hears about the first sign of T0813.
• Manual operation that exists only on paper: procedures that have not been rehearsed fail under pressure. The E-ISAC and SANS analysis of the Ukraine attack recommends planning for conservative operations and manual control.

Practitioner checklist

• Find and remove internet and public cellular exposure of controllers, RTUs and gateways.
• Replace default and shared device passwords with unique, vaulted credentials and an offline recovery record.
• Keep offline, tested copies of controller logic, configuration and gateway firmware.
• Provide an out-of-band communication path to critical remote sites and test it.
• Forward command failure and communication loss alarms to the OT SOC and correlate them with work orders.
• Monitor for controller configuration changes and firmware uploads outside change windows.
• Rehearse manual operation at each critical site at least once a year (NHI Mgmt Group recommendation).
• Write a response runbook that puts process safety and operations first and restores from known-good copies.

Standards and references

• MITRE ATT&CK for ICS: Denial of Control (T0813)
• MITRE ATT&CK: 2026 U.S. Water Utilities Attacks (C0066)
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
• E-ISAC and SANS ICS: Analysis of the Cyber Attack on the Ukrainian Power Grid
• ESET: Win32/Industroyer, A new threat for industrial control systems
• Tenable: Coordinated cyberattack on U.S. water utilities, what you need to know

Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · OT Security Guide · PLC Security Guide · OT Remote Access Guide · OT Incident Response Guide · T0815 Denial of View · T0827 Loss of Control · T0829 Loss of View