ATT&CK for ICS T0815 Denial of View Guide

Denial of View (T0815) blinds the control room: the HMI stops updating, values freeze or go stale, and operators cannot tell what the process is doing. MITRE ATT&CK for ICS places it under the Impact tactic and describes it as disrupting and preventing operator oversight of an ICS environment, typically as a temporary communication failure between a device and its control source that recovers once the interference stops. The danger is what happens during the gap: the process may be operating in an unintended or adversarial way while nobody can see it. This guide is for OT security engineers, SCADA administrators and incident responders. It covers how the technique differs from its neighbours, the recorded cases, how to spot a loss of view quickly, and how to keep operators informed while you recover. For the wider matrix see the MITRE ATT&CK for ICS Guide.

Key takeaways

It is temporary by definition. T0815 covers a loss of view that recovers when the interference stops; a sustained loss is Loss of View (T0829), and false values on the screen are Manipulation of View (T0832).
Stale data is the hardest symptom. A screen that keeps showing the last good value looks normal; quality flags, timestamps and heartbeat points are what reveal the gap.
There is no standard detection for the technique itself. ATT&CK v20 says so explicitly, so you detect the means (blocked reporting, denial of service, communication blocking) and the symptom (communication health).
ATT&CK's three mitigations are about resilience. Out-of-band communications (M0810), redundancy of service (M0811) and data backup (M0953) keep a second view available and shorten recovery.
Denial of view usually travels with something else. In the recorded cases it accompanied lockouts, control loss or serial channel takeover, so treat it as a sign of a wider incident.

What T0815 covers and how it differs from nearby techniques

ATT&CK describes an adversary preventing operators from receiving status and reporting messages, which can stop them noticing a change in state or anomalous behaviour. The technique has no platform listed (ATT&CK shows "None") because it describes an effect on the operator rather than a method on a specific system.

Technique	What the operator sees	Duration	Typical means
T0815 Denial of View	No updates, communication failure, frozen or stale values	Temporary	Blocked reporting messages, communication disruption
T0829 Loss of View	No view at all	Sustained or permanent	Wiped HMIs, destroyed servers or gateways
T0832 Manipulation of View	Values that look valid but are false	Any	Spoofed reporting, altered displays
T0813 Denial of Control	Commands do not take effect	Temporary	Blocked command path, changed device access
T0878 Alarm Suppression	Alarms do not appear	Any	Alarm settings or messages altered or blocked

The means overlap with Inhibit Response Function techniques such as T1691 Block Operational Technology Message, T1695 Block Communications and T0814 Denial of Service. See the ATT&CK for ICS Inhibit Response Function Tactic Guide and the companion HMI and SCADA Server Hardening Guide, which covers the HMI hosts themselves.

Real cases recorded by ATT&CK

ATT&CK v20 lists two procedure examples for T0815.

Industroyer (S0604): ATT&CK records that it can block serial COM channels temporarily, causing a denial of view. ESET's analysis explains that its IEC 101 payload opens the COM ports so that other processes cannot access them, which cuts the legitimate SCADA software off from the RTU and the status data it reports.
Maroochy Water Breach (C0020): ATT&CK records that the adversary temporarily shut an investigator out of the network, preventing them from viewing the state of the system.

Related campaigns show the same effect under other technique labels. CERT Polska's report on the 29 December 2025 attacks on Polish renewable farms describes lost communication between the farms and their distribution system operators, with remote control prevented while generation continued. The 2015 Ukraine attack, analysed by the E-ISAC and SANS, combined operator lockouts, wiped hosts and bricked serial-to-ethernet gateways. For the malware background see the ICS Malware History Guide.

Detecting a loss of view quickly

ATT&CK's detection strategy for T0815 contains one analytic: "No standard detection method currently exists for this technique." The practical answer is to instrument communication health so a loss of view is noticed in seconds, then investigate the cause through the precursor techniques.

Signal	Where to collect it	What it tells you
Point quality changes to bad, uncertain or not updated	SCADA and historian quality flags	The view of specific points is lost even if the screen looks normal
Heartbeat or watchdog point stops changing	A counter or toggling point configured on each controller and polled by SCADA	The whole path from controller to HMI is broken
Polling failures, retries and timeouts per device	SCADA communication statistics, front-end processor logs	Where in the path messages stop
Reporting traffic volume drops on an OT protocol	OT network monitoring with protocol decoding	Blocked or dropped reporting messages (T1691)
Unexpected process holding a serial port on a front-end host	Endpoint process telemetry	Serial channel takeover of the Industroyer kind (T1695)
Historian gaps across many tags at once	Historian data completeness reports	A shared failure point, useful for after-the-fact scoping

Making the signals useful

Configure heartbeats deliberately: a point that changes on a known schedule is the simplest end-to-end test of view. Alert on staleness beyond a few polling cycles.
Send communication alarms to security too: communication failure alarms usually stay in the control room. Forward them to the OT SOC and correlate with the maintenance calendar.
Compare two views: where a second path exists (an out-of-band link or a local panel), compare its values with SCADA. Disagreement points to manipulation, not just denial.

For sensor placement see the OT Network Security Monitoring Guide.

Mitigations: the three ATT&CK lists and how to apply them

Out-of-band communications channel (M0810): ATT&CK recommends redundant, out-of-band communication for monitoring and control, using diverse technologies to avoid common failure modes, with cellular networks given as an example of a diverse path. Secure the backup path with its own authentication and log it, because a poorly controlled cellular link can become an entry point.
Redundancy of service (M0811): hot-standby SCADA servers and front ends in diverse locations, and network redundancy such as the Parallel Redundancy Protocol, keep a view available when one component fails.
Data backup (M0953): hardened, separated backups and gold-copy images of HMI and SCADA servers shorten the time to restore a view. See the OT Backup, Recovery and Golden Image Guide.

Preventive controls sit upstream: segmentation of the paths between HMIs, front ends and field devices, removal of internet exposure, secured remote access and changed default passwords, as listed in the joint CISA, FBI, EPA and DOE primary mitigations for OT. Zone and conduit design is in the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.

Choosing between options

Situation	Preferred control	Trade-off
Remote sites on a single radio or leased line	Out-of-band channel for key status points	Extra link to secure and monitor
One SCADA server for the whole plant	Hot standby, ideally in a separate location	Licensing, configuration drift between primary and standby
Serial RTUs behind a front-end host	Endpoint monitoring on the front end, backup front end	Vendor approval for agents on the host
Small site with limited budget	Heartbeat points, local indication and a manual round procedure	Slower detection but cheap and robust

Safety-aware response

Switch to an alternative view: operators move to local panels, field rounds or the out-of-band path, and the control room decides whether the process can continue without full view.
Check the safety layer and alarms: confirm the safety instrumented system and alarm path are working, because a lost view may hide an abnormal state. See the Safety Instrumented Systems Security Guide.
Locate the break: use polling statistics, heartbeats and network data to find whether the HMI, server, network, gateway or controller is the failure point.
Treat it as a possible wider attack: look for concurrent control failures, configuration changes and firmware uploads, since denial of view often hides other activity.
Preserve evidence: keep historian data, communication logs, network captures and host images from the affected path before rebuilding.
Restore and verify: recover servers from known-good images, confirm that values on the HMI match field readings, and only then return to normal operation.

See the OT Incident Response Guide for the wider process.

Metrics that show it is working

Time to detect loss of view: measured in exercises from the start of a communication failure to an alert reaching the OT SOC.
Heartbeat coverage: share of controllers and remote sites with a monitored heartbeat point.
Second-view coverage: share of critical process areas with an alternative view (out-of-band link, local indication or redundant server).
Unexplained communication failures: count per month with no matching work order or known fault, and share investigated.
Restore time for HMI and SCADA servers: tested time to rebuild from gold images.

Framework mapping

Control area	NIST SP 800-53 Rev 5	NIST CSF 2.0	ATT&CK for ICS mitigation
Alternate communications	CP-8 Telecommunications Services; CP-11 Alternate Communications Protocols	PR.IR-03	M0810 Out-of-Band Communications Channel
Redundant servers and networks	CP-2 Contingency Plan; SC-5 Denial-of-service Protection	PR.IR-03	M0811 Redundancy of Service
Backups and rebuild	CP-9 System Backup; CP-10 System Recovery and Reconstitution	PR.DS-11; RC.RP-01	M0953 Data Backup
Communication health monitoring	SI-4 System Monitoring; AU-6 Audit Record Review, Analysis, and Reporting	DE.CM-01; DE.CM-09	No standard detection for T0815 itself
Segmentation of reporting paths	SC-7 Boundary Protection	PR.IR-01	M0930 Network Segmentation

For OT tailoring of these controls see the NIST SP 800-82 OT Security Guide.

Common failure patterns

Trusting a frozen screen: without quality flags and heartbeats, the last good value looks like a live one.
Communication alarms treated as routine faults: noisy telemetry teaches operators to ignore the first sign of T0815.
A backup path nobody secures: an unmanaged cellular link added for resilience becomes the entry point.
Redundant servers with the same weakness: a standby built from the same image with the same credentials fails at the same time.
Restoring view without checking the process: returning to automatic before field values are verified can hide manipulation that happened during the gap.

Practitioner checklist

Configure heartbeat points on controllers and alert on staleness at the HMI and in the OT SOC.
Display data quality and timestamps on operator screens for critical points.
Forward communication failure alarms to security and correlate with work orders.
Provide an out-of-band or local view for critical process areas and secure it.
Run hot-standby SCADA servers where one server supervises many sites.
Keep gold images of HMI and SCADA servers and test rebuild time.
Monitor front-end hosts for unexpected processes holding serial ports.
Rehearse operating with lost view at least once a year (NHI Mgmt Group recommendation).

T0815 Denial of View: Detection, Mitigation and Response