Updates - October 2021
The October 2021 (v10) ATT&CK release updates Techniques, Groups, and Software for Enterprise, Mobile, and ICS. The biggest change is the addition of a new set of Data Source and Data Component objects in Enterprise ATT&CK, complementing the ATT&CK Data Source name changes released in ATT&CK v9. An accompanying blog post describes these changes as well as improvements across ATT&CK's various domains and platforms.
In this release we have renamed T1185 and T1557 to be more inclusive, and deprecated T1053.004 to better reflect adversary behavior.
This version of ATT&CK for Enterprise contains 14 Tactics, 188 Techniques, 379 Sub-techniques, 129 Groups, and 637 Pieces of Software.
New Data Sources and/or Components in Enterprise ATT&CK:
Techniques
Enterprise
New Techniques:
Technique changes:
Minor Technique changes:
Technique revocations:
No changes
Technique deprecations:
Mobile
New Techniques:
Technique changes:
Minor Technique changes:
No changes
Technique revocations:
No changes
Technique deprecations:
No changes
Software
Enterprise
New Software:
Software changes:
Minor Software changes:
Software revocations:
No changes
Software deprecations:
No changes
Mobile
New Software:
Software changes:
Minor Software changes:
No changes
Software revocations:
No changes
Software deprecations:
No changes
Groups
Enterprise
New Groups:
Group changes:
Minor Group changes:
Group revocations:
Group deprecations:
Mobile
New Groups:
No changes
Group changes:
Minor Group changes:
No changes
Group revocations:
No changes
Group deprecations:
No changes
Mitigations
Enterprise
New Mitigations:
Mitigation changes:
No changes
Minor Mitigation changes:
No changes
Mitigation revocations:
No changes
Mitigation deprecations:
No changes
Mobile
New Mitigations:
No changes
Mitigation changes:
No changes
Minor Mitigation changes:
No changes
Mitigation revocations:
No changes
Mitigation deprecations:
No changes
Contributors to this release
- @ionstorm
- Achute Sharma, Keysight
- Arnim Rupp, Deutsche Lufthansa AG
- Atul Nair, Qualys
- Austin Clark
- Ayan Saha, Keysight
- Center for Threat-Informed Defense (CTID)
- Christoffer Strömblad
- Christopher Glyer, Mandiant, @cglyer
- Cody Thomas, SpecterOps
- Dan Borges, @1njection
- Daniel Prizmant, Palo Alto Networks
- Daniyal Naeem, BT Security
- Dor Edry, Microsoft
- Edward Millington
- Eli Salem, @elisalem9
- ExtraHop
- Gaetan van Diemen, ThreatFabric
- Gareth Phillips, Seek Ltd.
- Gordon Long, Box, Inc., @ethicalhax
- Harshal Tupsamudre, Qualys
- Hiroki Nagahama, NEC Corporation
- Isif Ibrahima
- Itamar Mizrahi, Cymptom
- Ivan Sinyakov
- Jack Burns, HubSpot
- Janantha Marasinghe
- Jaron Bradley @jbradley89
- Jeff Felling, Red Canary
- Joas Antonio dos Santos, @C0d3Cr4zy
- Johann Rehberger
- Jon Sheedy
- Jon Sternstein, Stern Security
- Jonathan Boucher, @crash_wave, Bank of Canada
- Jonhnathan Ribeiro, 3CORESec, @_w0rk3r
- Jorell Magtibay, National Australia Bank Limited
- Jorge Orchilles, SCYTHE
- Jose Luis Sánchez Martinez
- Josh Liburdi, @jshlbrd
- João Paulo de A. Filho, @Hug1nN__
- Jörg Abraham, EclecticIQ
- Karim Hasanen, @_karimhasanen
- Kiyohito Yamamoto, RedLark, NTT Communications
- Kyaw Pyiyt Htet, @KyawPyiytHtet
- Kyoung-ju Kwak (S2W)
- Lior Ribak, SentinelOne
- Manikantan Srinivasan, NEC Corporation India
- Maril Vernon, @shewhohacks
- Matt Brenton, Zurich Global Information Security
- Microsoft Detection and Response Team (DART)
- Microsoft Security
- Mike Burns, Mandiant
- Mnemonic AS
- Nagahama Hiroki, NEC Corporation
- Naveen Vijayaraghavan, Nilesh Dherange (Gurucul)
- Nick Carr, Mandiant
- Omkar Gudhate
- Patrick Sungbahadoor
- Pooja Natarajan, NEC Corporation India
- Prasanth Sadanala, Cigna Information Protection (CIP) - Threat Response Engineering Team
- Regina Elwell
- Rex Guo, @Xiaofei_REX, Confluera
- Rick Cole, Mandiant
- Ruben Dodge, @shotgunner101
- Shlomi Salem, SentinelOne
- SOCCRATES
- Stan Hegt, Outflank
- Ted Samuels, Rapid7
- Tim (Wadhwa-)Brown
- Toby Kohlenberg
- Vadim Khrykov
- Viren Chaudhari, Qualys
- Wes Hurd
- Will Thomas, Cyjax
- William Cain
- Yoshihiro Kori, NEC Corporation
- Yossi Nisani, Cymptom
- Yusuke Kubo, RedLark, NTT Communications
- Yuval Avrahami, Palo Alto Networks
- Zaw Min Htun, @Z3TAE
- Ziv Kaspersky, Cymptom