Taking a look back at 2019 and presenting a 2020 roadmap for ATT&CK Written by Blake Strom and Amy Robertson We started 2019 with a bold series of goals, and with the help of the MITRE ATT&CK® community and hard work from our team, we‘ve accomplished many of those and…

Sub-techniques are coming… soon! We know everyone’s been waiting for an update, so here it is. The ATT&CK Team has been working hard implementing sub-techniques since ATT&CKcon, but sub-techniques aren’t quite ready yet. I can now say that we’re planning a late March 2020 soft launch of ATT&CK with sub-techniques…

ATT&CK has been in constant development for about six years now. Over that time, ATT&CK has grown quite a bit while still sticking to our original design decisions. …

Written by Blake Strom, Tim Schulz, and Katie Nickels We hope you have taken the time to read both Katie Nickels’s post on getting started using ATT&CK for threat intelligence and John Wunder’s post on using ATT&CK for detection and analytics! …

This post was originally published June 24, 2018 on mitre.org. We started ATT&CK almost five years ago as a way to categorize common adversary behavior for adversary emulation and intrusion detection research. The project has grown quite a bit since then, both in content and in the process for maintaining…

This post was originally published April 13, 2018 on mitre.org. Written by Kristin Esbeck and Blake Strom What’s New in ATT&CK and PRE-ATT&CK With the latest release of ATT&CK and PRE-ATT&CK, we decided to make the following changes: Creation of the new Initial Access tactic category in ATT&CK Deprecation of the Launch and Compromise tactic categories…

This post was originally published May 3, 2018 on mitre.org. Why ATT&CK was Created MITRE started ATT&CK in 2013 to document common tactics, techniques, and procedures (TTPs) that advanced persistent threats use against Windows enterprise networks. ATT&CK was created out of a need to document adversary behaviors for use within a MITRE research project…