ATT&CK v20
20.10.26
MITRE
Security
Updates - October 2026
The October 2026 (v20) ATT&CK release updates Techniques, Groups, Campaigns and
Software for Enterprise, Mobile, and ICS.
The biggest change in ATT&CK v20 is expanded coverage of recent adversary
activity and tradecraft, including new Campaigns covering attacks on U.S. water
utilities and an AI-assisted breach of Mexican government infrastructure, along
with AI-focused and AI-enabled Techniques in Enterprise and execution and
command and control Techniques in ICS.
It also un-deprecates the Mobile Technique Deliver Malicious Application via
Other Means, last seen in ATT&CK v11. ICS Detection Strategies now include
platform and Asset context, and Mobile Detection Strategies account for the
visibility limits of Android and iOS.
An
accompanying blog post describes these changes as well as additional
improvements across ATT&CK's various domains and platforms.
This release also includes a human-readable detailed changelog showing more
specifically what changed in updated ATT&CK objects, and a machine-readable JSON
changelog, whose format is described in
ATT&CK's GitHub.
This version of ATT&CK contains 971 Software, 182 Groups, and 61 Campaigns.
Broken out by domain:
-
Enterprise: 15 Tactics, 227 Techniques,
479 Sub-Techniques, 178 Groups, 842 Pieces of Software, 57 Campaigns, 44
Mitigations, 703 Detection Strategies, 1770 Analytics, and 106 Data
Components
-
Mobile: 12 Tactics, 78 Techniques, 47
Sub-Techniques, 20 Groups, 128 Pieces of Software, 3 Campaigns, 13
Mitigations, 124 Detection Strategies, 211 Analytics, and 29 Data Components
- ICS: 12 Tactics, 78 Techniques, 26 Sub-Techniques,
14 Groups, 25 Pieces of Software, 10 Campaigns, 53 Mitigations, 18 Assets,
106 Detection Strategies, 302 Analytics, and 36 Data Components
-
New objects: ATT&CK objects which are
only present in the new release.
- Major version changes: ATT&CK objects
that have a major version change. (e.g. 1.0 → 2.0)
- Minor version changes: ATT&CK objects
that have a minor version change. (e.g. 1.0 → 1.1)
- Other version changes: ATT&CK objects
that have a version change of any other kind. (e.g. 1.0 → 1.2)
- Patches: ATT&CK objects that have been
patched while keeping the version the same. (e.g., 1.0 → 1.0 but something
like a typo, a URL, or some metadata was fixed)
- Object revocations: ATT&CK objects which
are revoked by a different object.
- Object deprecations: ATT&CK objects
which are deprecated and no longer in use, and not replaced.
- Object deletions: ATT&CK objects which
are no longer found in the STIX data.
-
Application Log Content
(v3.0→v3.1)
-
Command Execution
(v2.1→v2.2)
-
File Access
(v3.0→v3.1)
-
File Creation
(v3.0→v3.1)
-
Host Status
(v2.1→v2.2)
-
Logon Session Creation
(v2.0→v2.1)
-
Module Load
(v3.0→v3.1)
-
Network Connection Creation
(v2.1→v2.2)
-
Network Traffic Content
(v2.1→v2.2)
-
Network Traffic Flow
(v2.1→v2.2)
-
OS API Execution
(v2.1→v2.2)
-
Process Creation
(v2.1→v2.2)
-
Process Metadata
(v2.1→v2.2)
-
Cloud Service Enumeration
(v3.0)
-
Drive Creation
(v2.0)
-
Driver Load
(v2.0)
-
File Deletion
(v3.0)
-
File Metadata
(v2.1)
-
File Modification
(v3.0)
-
Firewall Metadata
(v2.0)
-
Firewall Rule Modification
(v2.0)
-
Firmware Modification
(v2.0)
-
Logon Session Metadata
(v2.0)
-
Network Share Access
(v2.0)
-
Process Access
(v3.0)
-
Process Termination
(v2.0)
-
Scheduled Job Creation
(v3.0)
-
Script Execution
(v2.0)
-
Service Creation
(v2.0)
-
Service Metadata
(v2.0)
-
User Account Authentication
(v3.0)
-
User Account Modification
(v2.0)
-
Windows Registry Key Modification
(v2.0)
-
Application Log Content
(v3.0→v3.1)
-
Application Permission
(v2.1→v2.2)
-
Application State
(v1.0→v1.1)
-
Command Execution
(v2.1→v2.2)
-
File Access
(v3.0→v3.1)
-
File Creation
(v3.0→v3.1)
-
Host Status
(v2.1→v2.2)
-
Module Load
(v3.0→v3.1)
-
Network Connection Creation
(v2.1→v2.2)
-
Network Traffic Content
(v2.1→v2.2)
-
Network Traffic Flow
(v2.1→v2.2)
-
OS API Execution
(v2.1→v2.2)
-
Process Creation
(v2.1→v2.2)
-
Process Metadata
(v2.1→v2.2)
-
System Settings
(v2.1→v2.2)
-
API Calls
(v2.1)
-
Cloud Service Enumeration
(v3.0)
-
File Deletion
(v3.0)
-
File Metadata
(v2.1)
-
File Modification
(v3.0)
-
Network Communication
(v2.1)
-
Permissions Request
(v2.0)
-
Process Access
(v3.0)
-
Process Termination
(v2.0)
-
Protected Configuration
(v2.1)
-
Scheduled Job Creation
(v3.0)
-
System Notifications
(v2.1)
-
User Account Authentication
(v3.0)
-
Application Log Content
(v3.0→v3.1)
-
Command Execution
(v2.1→v2.2)
-
File Access
(v3.0→v3.1)
-
File Creation
(v3.0→v3.1)
-
Logon Session Creation
(v2.0→v2.1)
-
Module Load
(v3.0→v3.1)
-
Network Connection Creation
(v2.1→v2.2)
-
Network Traffic Content
(v2.1→v2.2)
-
Network Traffic Flow
(v2.1→v2.2)
-
OS API Execution
(v2.1→v2.2)
-
Process Creation
(v2.1→v2.2)
-
Process Metadata
(v2.1→v2.2)
-
Asset Inventory
(v2.0)
-
Device Alarm
(v2.0)
-
Drive Creation
(v2.0)
-
File Deletion
(v3.0)
-
File Metadata
(v2.1)
-
File Modification
(v3.0)
-
Firmware Modification
(v2.0)
-
Logon Session Metadata
(v2.0)
-
Network Share Access
(v2.0)
-
Process History/Live Data
(v2.1)
-
Process Termination
(v2.0)
-
Process/Event Alarm
(v2.1)
-
Scheduled Job Creation
(v3.0)
-
Script Execution
(v2.0)
-
Service Creation
(v2.0)
-
Service Metadata
(v2.0)
-
Software
(v2.0)
-
User Account Authentication
(v3.0)
-
Windows Registry Key Modification
(v2.0)
-
Alberto Arroba García
- Bridger Hackworth (NR Labs)
- Caio Silva
- Girshel Chokhonelidze
- Jeremy Ang
- Liran Ravich, Cribl
- Menachem Goldstein
- Pooja Natarajan, NEC Corporation India
- Riku Katsuse, NEC Corporation
- Sareena Karapoola, NEC Corporation India
- Stephan H. Wenderlich, Gray-Hat
IT-Security Consulting
- Vijay Lalwani