Sign in

MITRE ATT&CK

MITRE ATT&CK knowledge base of adversary tactics and techniques — MITRE Corporation

Also known as: ATT&CK, ATTACK, MITRE ATTACK, ATT&CK Enterprise, ATT&CK ICS, ATT&CK Mobile

Official site Official change log Subscribe to MITRE ATT&CK (RSS)

Current version
ATT&CK v20
Published 13 October 2026. source
Status
In force
Next deadline
None announced
Who must comply
Security operations, threat intelligence and security architecture work, and products and services that build on it, across the Enterprise, Mobile and ICS domains. source source
How it is assessed
MITRE does not endorse organizations or products that use ATT&CK, and ATT&CK may not be used in a way that implies such an endorsement. source
Written by
Curated by The MITRE Corporation, which owns the MITRE ATT&CK and ATT&CK trademarks and releases new major versions listed on its Updates pages. source source
Enforced by
The rules MITRE sets for users are its Terms of Use and its trademark and referencing guidelines. source
Last change

The reference taxonomy of adversary behaviour, used by security operations, threat intelligence and security architecture teams and mapped to by other frameworks in this catalogue.

Recent changes

  1. Info
    CISA, FBI and partners release advisory on SafePay ransomware actors targeting critical infrastructure

    CISA, FBI, U.S. Secret Service and international partners released a joint advisory warning of SafePay ransomware actors, identified as one of the most active ransomware groups …

    Other Enforcement

  2. Low
    Frontier Ready Assessment Framework published

    The Cloud Security Alliance has published the Frontier Ready Assessment Framework as a new resource on its publications page. The framework addresses threats from AI-enabled adversaries …

    New document

Key dates

No upcoming dates
  1. ATT&CK v20 released
  2. ATT&CK v19 released, splitting Defense Evasion into the Stealth and Defense Impairment Tactics
  3. ATT&CK v18 released, replacing Detections with Detection Strategies and Analytics

Version history

  1. ATT&CK v20 Major versionCurrent

    October 2026 release expanding coverage of recent adversary activity, with AI-focused and AI-enabled Enterprise Techniques and new ICS execution and command and control Techniques. source

    More
    • New Campaigns cover attacks on US water utilities and an AI-assisted breach of Mexican government infrastructure.
    • Un-deprecates the Mobile Technique Deliver Malicious Application via Other Means, last seen in v11.
    • ICS Detection Strategies now include platform and Asset context.
    • Enterprise now has 15 Tactics, 227 Techniques and 479 Sub-Techniques; ICS has 78 Techniques and 26 Sub-Techniques.
  2. ATT&CK v19 Major version

    Split the Enterprise Defense Evasion Tactic into Stealth and Defense Impairment, added Sub-Techniques to ICS and started Detection Strategies in Mobile. source

    More
    • Minor releases v19.1 and v19.2 followed; v19.2 release notes are under Updates - August 2026.
  3. ATT&CK v18 Major version

    Replaced Detections in Techniques with Detection Strategies and Analytics, made major updates to Data Components and deprecated Data Sources. source

    More
    • Un-deprecated the Mobile Technique Abuse Accessibility Features, last seen in v6.
  4. ATT&CK v17 Major version

    Added an ESXi platform to Enterprise, rewrote Enterprise Mitigation descriptions and renamed the Network platform to Network Devices. source

    More
    • Revoked Hijack Execution Flow: DLL Side-Loading and merged it into Hijack Execution Flow: DLL, renamed from DLL Search Order Hijacking.
  5. ATT&CK v16 Major version

    Refactored the Cloud platforms: Azure AD, Office 365 and Google Workspace were replaced by the Identity Provider and Office Suite platforms. source

Who it applies to

Open to any person or organization at no charge; it is a knowledge base, not a set of requirements.

What it is
A knowledge base of cyber adversary behavior and a taxonomy for adversarial actions across their lifecycle. source
Domains
Releases cover three domains: Enterprise, Mobile and ICS, each with its own Tactics, Techniques, Mitigations and Detection Strategies. source
Free use
ATT&CK is open and available to any person or organization for use at no charge, under its Terms of Use. source
Versioning
Releases listed on the Updates pages increment the major version; minor versions carry typo and data corrections but typically no new content. source
Changelogs
Each release has a human-readable detailed changelog and a machine-readable JSON changelog of changed ATT&CK objects. source

How compliance is assessed

MITRE does not endorse organizations or products that use ATT&CK, and ATT&CK may not be used in a way that implies such an endorsement.

No endorsement
MITRE does not endorse organizations or individuals leveraging MITRE ATT&CK in their work, and including ATT&CK does not imply MITRE endorsement or support. source
Using the name
ATT&CK may not be used in a way that implies an endorsement of a product or service, or in product, service or company names. source source

Enforcement and penalties

The rules MITRE sets for users are its Terms of Use and its trademark and referencing guidelines.

Trademarks
MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation, with rules on how they may be referenced. source
Terms of Use
Anyone using ATT&CK is asked to follow its Terms of Use and referencing guidelines. source source

Documents

  1. Guidance ATT&CK Version History
  2. Guidance ATT&CK Updates (current release notes)
  3. FAQ ATT&CK FAQ
  4. Guidance ATT&CK Legal and Branding
  5. Standard ATT&CK STIX data releases

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to MITRE ATT&CK (RSS)