Loss of Control
Technique · ATTACK:ics:T0827
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:T0827",
"title": "Loss of Control",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T0827",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb",
"external_id": "T0827",
"domain": "ics",
"created": "2020-05-21T17:43:26.506Z",
"modified": "2026-05-12T15:12:00.706Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"impact"
],
"source_references": [
{
"source_name": "BSI State of IT Security 2014",
"url": "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/Securitysituation/IT-Security-Situation-in-Germany-2014.pdf?__blob=publicationFile&v=3"
},
{
"source_name": "Corero",
"url": "https://www.corero.com/resources/files/whitepapers/cns_whitepaper_ics.pdf"
},
{
"source_name": "Michael J. Assante and Robert M. Lee",
"url": "https://icscsi.org/library/Documents/White_Papers/SANS%20-%20ICS%20Cyber%20Kill%20Chain.pdf"
},
{
"source_name": "Tyson Macaulay",
"url": "https://books.google.com/books?id=oXIYBAAAQBAJ&pg=PA249&lpg=PA249&dq=loss+denial+manipulation+of+view&source=bl&ots=dV1uQ8IUff&sig=ACfU3U2NIwGjhg051D_Ytw6npyEk9xcf4w&hl=en&sa=X&ved=2ahUKEwj2wJ7y4tDlAhVmplkKHSTaDnQQ6AEwAHoECAgQAQ#v=onepage&q=loss%20denial%20manipulation%20of%20view&f=false"
}
]
}Explicit source assertions (9)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:M0953 → mitigates → ATTACK:ics:T0827
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ad39b3a-a962-457f-852c-be7fc615e22f
Department of Homeland Security October 2009ATTACK:ics:M0811 → mitigates → ATTACK:ics:T0827
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7041d8e5-3b74-402a-86b3-fd59def80632
M. Rentschler and H. HeineATTACK:ics:C0066 → uses → ATTACK:ics:T0827
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--862d5dbb-4582-4a9b-877a-e323233b53fe
FBI Water and Wastewater · Dragos Water Under Attack · Tenable Minnesota Water Utilities · Forescout Water Systems AttackATTACK:ics:M0810 → mitigates → ATTACK:ics:T0827
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b17ad46-b0cc-4766-9cae-eba32260d468
National Institute of Standards and Technology April 2013ATTACK:ics:S0604 → uses → ATTACK:ics:T0827
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6d8b66d-fc10-404f-b0ae-e8c66506b818
Anton Cherepanov, ESET June 2017ATTACK:ics:G1027 → uses → ATTACK:ics:T0827
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ab85bff5-7f2a-400c-a86e-b63747200e1f
CISA-AA26-097AATTACK:ics:S0372 → uses → ATTACK:ics:T0827
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5ab26e2-eb90-4f19-b35a-b8a0a5438961
Hydro · Kevin BeaumontATTACK:ics:C0063 → uses → ATTACK:ics:T0827
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bdae915d-64f8-4944-949c-59a4d35b70c5
CERT PolskaATTACK:ics:C0028 → uses → ATTACK:ics:T0827
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d1388bba-9869-4e3e-a6c9-430784ad924d
Ukraine15 - EISAC - 201603