| Version | Start Date | End Date | Data | Changelogs |
|---|---|---|---|---|
| ATT&CK v12 | October 25, 2022 | April 24, 2023 | v12.0 on MITRE/CTI v12.1 on MITRE/CTI |
11.3 - 12.0 Details (JSON) 12.0 - 12.1 Details (JSON) |
The October 2022 (v12) ATT&CK release updates Techniques, Groups, and Software for Enterprise, Mobile, and ICS. The biggest changes in ATT&CK v12 are the addition of detections to ATT&CK for ICS, and the introduction of Campaigns.
Matching the model introduced to ATT&CK for Enterprise in ATT&CK v11, ATT&CK for ICS detections describe ways of detecting various ICS techniques and are each tied to specific Data Sources and Data Components. This detection format was described in detail in our ATT&CK v11 release blog post. The new detections added leverage both traditional host and network-based collection as well as ICS specific sources such as Asset and Operational Databases. As there are overlaps between the Enterprise and ICS ATT&CK domains some ICS detections include references to Enterprise techniques where the additional context may assist defenders.
This release introduces the Campaign data structure to ATT&CK and an initial limited set of Campaigns. ATT&CK's Campaigns are defined as a grouping of intrusion activity conducted over a specific period of time with common targets and objectives. A key aspect of Campaigns is that the activity may or may not be linked to a specific threat actor. Campaigns are described in detail in the blog post Introducing Campaigns to MITRE ATT&CK. Specifics on how Campaigns are implemented in ATT&CK's Enterprise, ICS, and Mobile STIX representations are described in ATT&CK's STIX 2.0 Data Model and STIX 2.1 Data Model. Several existing Groups were identified as more closely matching the Campaign than the Group definition and were converted to Campaigns. The 7 impacted groups were deprecated (noted below) and new Campaigns were created in their place.
In this release we have renamed the Enterprise Technique "Indicator Removal on Host" to Indicator Removal (T1070) and rescoped it to better account for adversary behavior in cloud environments.
This version of ATT&CK for Enterprise contains 14 Tactics, 193 Techniques, 401 Sub-techniques, 135 Groups, 14 Campaigns, and 718 Pieces of Software.
ATT&CK for Mobile does not support structured data sources