ATT&CK is in a constant state of development. We are always on the lookout for new information to help refine and extend what is covered. If you have additional techniques, know about variations on one already covered, have examples of techniques in use, or have other relevant information, then we would like to hear from you.
We are looking for contributions in the following areas, but all contributions and feedback to ATT&CK are appreciated. If you have other information you think may be useful, please reach us at attack@mitre.org.
Due to the high volume of contributions, it may take us about a week to get back to you. We recommend you read our philosophy paper to understand our approach to maintaining ATT&CK so that we get the right details up front. Content updates happen roughly every 6 months.
Let us know what new variations of behaviors real adversaries are using in the wild! Please share
a brief description of the behavior, any references or knowledge about how it works and was used,
and how this behavior is not already captured in ATT&CK.
To understand the process of how
the MITRE team develops techniques, refer to the video below.
We map Group and Software examples on our site, and appreciate your help with referenced information about how Groups and Software samples use ATT&CK techniques. Please share the sub-technique or technique name, group or associated group name, a brief description of how the technique is implemented, and the publicly-available reference.
If you find errors or typos on the site related to content, please let us know by submitting the url where you found the error and a short description. Examples include typos and syntax errors, improperly formatted web pages, and 404 errors when links are clicked.
The following individuals or organizations have contributed information regarding the existence of a technique, details on how to detect and/or mitigate use of a technique, or threat intelligence on adversary use:
Thanks to those who have contributed to ATT&CK!