Updates - October 2021

Version Start Date End Date Data
ATT&CK v10 October 21, 2021 April 24, 2022 v10.1 on MITRE/CTI

The October 2021 (v10) ATT&CK release updates Techniques, Groups, and Software for Enterprise, Mobile, and ICS. The biggest change is the addition of a new set of Data Source and Data Component objects in Enterprise ATT&CK, complementing the ATT&CK Data Source name changes released in ATT&CK v9. An accompanying blog post describes these changes as well as improvements across ATT&CK's various domains and platforms.

In this release we have renamed T1185 and T1557 to be more inclusive, and deprecated T1053.004 to better reflect adversary behavior.

This version of ATT&CK for Enterprise contains 14 Tactics, 188 Techniques, 379 Sub-techniques, 129 Groups, and 637 Pieces of Software.

New Data Sources and/or Components in Enterprise ATT&CK:

Techniques

Enterprise

New Techniques:

Technique changes:

Minor Technique changes:

Technique revocations: No changes

Technique deprecations:

Mobile

New Techniques:

Technique changes:

Minor Technique changes: No changes

Technique revocations: No changes

Technique deprecations: No changes

Software

Enterprise

New Software:

Software changes:

Minor Software changes:

Software revocations: No changes

Software deprecations: No changes

Mobile

New Software:

Software changes:

Minor Software changes: No changes

Software revocations: No changes

Software deprecations: No changes

Groups

Enterprise

New Groups:

Group changes:

Minor Group changes:

Group revocations:

  • Stolen Pencil (revoked by Kimsuky)

Group deprecations:

Mobile

New Groups: No changes

Group changes:

Minor Group changes: No changes

Group revocations: No changes

Group deprecations: No changes

Mitigations

Enterprise

New Mitigations:

Mitigation changes: No changes

Minor Mitigation changes: No changes

Mitigation revocations: No changes

Mitigation deprecations: No changes

Mobile

New Mitigations: No changes

Mitigation changes: No changes

Minor Mitigation changes: No changes

Mitigation revocations: No changes

Mitigation deprecations: No changes

Contributors to this release

  • @ionstorm
  • Achute Sharma, Keysight
  • Arnim Rupp, Deutsche Lufthansa AG
  • Atul Nair, Qualys
  • Austin Clark
  • Ayan Saha, Keysight
  • Center for Threat-Informed Defense (CTID)
  • Christoffer Strömblad
  • Christopher Glyer, Mandiant, @cglyer
  • Cody Thomas, SpecterOps
  • Dan Borges, @1njection
  • Daniel Prizmant, Palo Alto Networks
  • Daniyal Naeem, BT Security
  • Dor Edry, Microsoft
  • Edward Millington
  • Eli Salem, @elisalem9
  • ExtraHop
  • Gaetan van Diemen, ThreatFabric
  • Gareth Phillips, Seek Ltd.
  • Gordon Long, Box, Inc., @ethicalhax
  • Harshal Tupsamudre, Qualys
  • Hiroki Nagahama, NEC Corporation
  • Isif Ibrahima
  • Itamar Mizrahi, Cymptom
  • Ivan Sinyakov
  • Janantha Marasinghe
  • Jaron Bradley @jbradley89
  • Jeff Felling, Red Canary
  • Jen Burns, HubSpot
  • Joas Antonio dos Santos, @C0d3Cr4zy
  • Johann Rehberger
  • Jon Sheedy
  • Jon Sternstein, Stern Security
  • Jonathan Boucher, @crash_wave, Bank of Canada
  • Jonhnathan Ribeiro, 3CORESec, @_w0rk3r
  • Jorell Magtibay, National Australia Bank Limited
  • Jorge Orchilles, SCYTHE
  • Jose Luis Sánchez Martinez
  • Josh Liburdi, @jshlbrd
  • João Paulo de A. Filho, @Hug1nN__
  • Jörg Abraham, EclecticIQ
  • Karim Hasanen, @_karimhasanen
  • Kiyohito Yamamoto, RedLark, NTT Communications
  • Kyaw Pyiyt Htet, @KyawPyiytHtet
  • Kyoung-ju Kwak (S2W)
  • Lior Ribak, SentinelOne
  • Manikantan Srinivasan, NEC Corporation India
  • Maril Vernon, @shewhohacks
  • Matt Brenton, Zurich Global Information Security
  • Microsoft Detection and Response Team (DART)
  • Microsoft Security
  • Mike Burns, Mandiant
  • Mnemonic AS
  • Nagahama Hiroki, NEC Corporation
  • Naveen Vijayaraghavan, Nilesh Dherange (Gurucul)
  • Nick Carr, Mandiant
  • Omkar Gudhate
  • Patrick Sungbahadoor
  • Pooja Natarajan, NEC Corporation India
  • Prasanth Sadanala, Cigna Information Protection (CIP) - Threat Response Engineering Team
  • Regina Elwell
  • Rex Guo, @Xiaofei_REX, Confluera
  • Rick Cole, Mandiant
  • Ruben Dodge, @shotgunner101
  • Shlomi Salem, SentinelOne
  • SOCCRATES
  • Stan Hegt, Outflank
  • Ted Samuels, Rapid7
  • Tim (Wadhwa-)Brown
  • Toby Kohlenberg
  • Vadim Khrykov
  • Viren Chaudhari, Qualys
  • Wes Hurd
  • Will Thomas, Cyjax
  • William Cain
  • Yoshihiro Kori, NEC Corporation
  • Yossi Nisani, Cymptom
  • Yusuke Kubo, RedLark, NTT Communications
  • Yuval Avrahami, Palo Alto Networks
  • Zaw Min Htun, @Z3TAE
  • Ziv Kaspersky, Cymptom