Updates - October 2024

Version	Start Date	End Date	Data	Changelogs
ATT&CK v16	October 31, 2024	April 21, 2025	v16.0 on MITRE/CTI v16.1 on MITRE/CTI	15.1 - 16.0 Details (JSON) 16.0 - 16.1 Details (JSON)

The October 2024 (v16) ATT&CK release updates Techniques, Groups, Campaigns and Software for Enterprise.

The biggest changes in ATT&CK v16 are a refactoring of Cloud platforms to better reflect real-world adversary activity along with improvements to platform descriptions, a dramatic expansion in the number of techniques with detection notes and analytics, and continued improvements to coverage of criminal threat actors. As a result of Cloud platform refactoring, the Azure AD, Office 365, and Google Workspace platforms have been removed from Enterprise ATT&CK and the Identity Provider and Office Suite platforms have been added in their place. An accompanying blog post describes these changes as well as additional improvements across Enterprise ATT&CK's various platforms.

This release also includes a human-readable detailed changelog showing more specifically what changed in updated ATT&CK objects, and a machine-readable JSON changelog, whose format is described in ATT&CK's Github.

This version of ATT&CK contains 844 Pieces of Software, 186 Groups, and 42 Campaigns
Broken out by domain:

Enterprise: 14 Tactics, 203 Techniques, 453 Sub-Techniques, 159 Groups, 710 Pieces of Software, 34 Campaigns, 44 Mitigations, and 37 Data Sources
Mobile: 12 Tactics, 73 Techniques, 46 Sub-Techniques, 13 Groups, 112 Pieces of Software, 2 Campaigns, 13 Mitigations, and 6 Data Sources
ICS: 12 Tactics, 83 Techniques, 0 Sub-Techniques, 14 Groups, 22 Pieces of Software, 6 Campaigns, 52 Mitigations, 14 Assets, and 17 Data Sources

Release Notes Terminology

New: ATT&CK objects which are only present in the new release.
Major version changes: ATT&CK objects that have a major version change. (e.g. 1.0 → 2.0)
Minor version changes: ATT&CK objects that have a minor version change. (e.g. 1.0 → 1.1)
Other version changes: ATT&CK objects that have a version change of any other kind. (e.g. 1.0 → 1.2)
Patches: ATT&CK objects that have been patched while keeping the version the same. (e.g., 1.0 → 1.0 but something immaterial like a typo, a URL, or some metadata was fixed)
Revocations: ATT&CK objects which are revoked by a different object.
Deprecations: ATT&CK objects which are deprecated and no longer in use, and not replaced.
Deletions: ATT&CK objects which are no longer found in the STIX data.

Account Manipulation: Additional Local or Domain Groups (v1.0)
Adversary-in-the-Middle: Evil Twin (v1.0)
Application Layer Protocol: Publish/Subscribe Protocols (v1.0)
Command and Scripting Interpreter: Lua (v1.0)
Data Destruction: Lifecycle-Triggered Deletion (v1.0)
Data from Information Repositories: Customer Relationship Management Software (v1.0)
Data from Information Repositories: Messaging Applications (v1.0)
Event Triggered Execution: Udev Rules (v1.0)
Execution Guardrails: Mutual Exclusion (v1.0)
Indicator Removal: Relocate Malware (v1.0)
Masquerading: Masquerade Account Name (v1.0)
Modify Cloud Resource Hierarchy (v1.0)
Obfuscated Files or Information: Polymorphic Code (v1.0)
Resource Hijacking: Bandwidth Hijacking (v1.0)
Resource Hijacking: Cloud Service Hijacking (v1.0)
Resource Hijacking: Compute Hijacking (v1.0)
Resource Hijacking: SMS Pumping (v1.0)
Steal or Forge Kerberos Tickets: Ccache Files (v1.0)
Trusted Developer Utilities Proxy Execution: ClickOnce (v1.0)