CINXE.COM

<!doctype html><html lang="en"><head><title data-rh="true">Introducing ATT&CK v10: More Objects, Parity, and Features | MITRE ATT&CK®</title><meta data-rh="true" charset="utf-8"/><meta data-rh="true" name="viewport" content="width=device-width,minimum-scale=1,initial-scale=1,maximum-scale=1"/><meta data-rh="true" name="theme-color" content="#000000"/><meta data-rh="true" name="twitter:app:name:iphone" content="Medium"/><meta data-rh="true" name="twitter:app:id:iphone" content="828256236"/><meta data-rh="true" property="al:ios:app_name" content="Medium"/><meta data-rh="true" property="al:ios:app_store_id" content="828256236"/><meta data-rh="true" property="al:android:package" content="com.medium.reader"/><meta data-rh="true" property="fb:app_id" content="542599432471018"/><meta data-rh="true" property="og:site_name" content="Medium"/><meta data-rh="true" property="og:type" content="article"/><meta data-rh="true" property="article:published_time" content="2021-10-21T15:50:37.317Z"/><meta data-rh="true" name="title" content="Introducing ATT&CK v10: More Objects, Parity, and Features | MITRE ATT&CK®"/><meta data-rh="true" property="og:title" content="Introducing ATT&CK v10: More Objects, Parity and Features"/><meta data-rh="true" property="al:android:url" content="medium://p/7743870b37e3"/><meta data-rh="true" property="al:ios:url" content="medium://p/7743870b37e3"/><meta data-rh="true" property="al:android:app_name" content="Medium"/><meta data-rh="true" name="description" content="As announced a couple of weeks ago, we’re back with the latest release and we’re thrilled to reveal all the updates and features waiting for you in ATT&CK v10. The v10 release includes the next…"/><meta data-rh="true" property="og:description" content="Detailing the content and feature updates just released in ATT&CK v10"/><meta data-rh="true" property="og:url" content="https://medium.com/mitre-attack/introducing-attack-v10-7743870b37e3"/><meta data-rh="true" property="al:web:url" content="https://medium.com/mitre-attack/introducing-attack-v10-7743870b37e3"/><meta data-rh="true" property="og:image" content="https://miro.medium.com/v2/resize:fit:512/1*aghj7RR33HlT_i1FVYx_eQ.jpeg"/><meta data-rh="true" property="article:author" content="https://medium.com/@arobertson_79988"/><meta data-rh="true" name="author" content="Amy L. Robertson"/><meta data-rh="true" name="robots" content="index,noarchive,follow,max-image-preview:large"/><meta data-rh="true" name="referrer" content="unsafe-url"/><meta data-rh="true" property="twitter:title" content="Introducing ATT&CK v10: More Objects, Parity and Features"/><meta data-rh="true" name="twitter:site" content="@mitreattack"/><meta data-rh="true" name="twitter:app:url:iphone" content="medium://p/7743870b37e3"/><meta data-rh="true" property="twitter:description" content="Detailing the content and feature updates just released in ATT&CK v10"/><meta data-rh="true" name="twitter:image:src" content="https://miro.medium.com/v2/resize:fit:512/1*aghj7RR33HlT_i1FVYx_eQ.jpeg"/><meta data-rh="true" name="twitter:card" content="summary_large_image"/><meta data-rh="true" name="twitter:label1" content="Reading time"/><meta data-rh="true" name="twitter:data1" content="6 min read"/><link data-rh="true" rel="icon" href="https://miro.medium.com/v2/5d8de952517e8160e40ef9841c781cdc14a5db313057fa3c3de41c6f5b494b19"/><link data-rh="true" rel="search" type="application/opensearchdescription+xml" title="Medium" href="/osd.xml"/><link data-rh="true" rel="apple-touch-icon" sizes="152x152" href="https://miro.medium.com/v2/resize:fill:304:304/10fd5c419ac61637245384e7099e131627900034828f4f386bdaa47a74eae156"/><link data-rh="true" rel="apple-touch-icon" sizes="120x120" href="https://miro.medium.com/v2/resize:fill:240:240/10fd5c419ac61637245384e7099e131627900034828f4f386bdaa47a74eae156"/><link data-rh="true" rel="apple-touch-icon" sizes="76x76" href="https://miro.medium.com/v2/resize:fill:152:152/10fd5c419ac61637245384e7099e131627900034828f4f386bdaa47a74eae156"/><link data-rh="true" rel="apple-touch-icon" sizes="60x60" href="https://miro.medium.com/v2/resize:fill:120:120/10fd5c419ac61637245384e7099e131627900034828f4f386bdaa47a74eae156"/><link data-rh="true" rel="mask-icon" href="https://miro.medium.com/v2/resize:fill:1000:1000/7*GAOKVe--MXbEJmV9230oOQ.png" color="#171717"/><link data-rh="true" rel="preconnect" href="https://glyph.medium.com" crossOrigin=""/><link data-rh="true" id="glyph_preload_link" rel="preload" as="style" type="text/css" href="https://glyph.medium.com/css/unbound.css"/><link data-rh="true" id="glyph_link" rel="stylesheet" type="text/css" href="https://glyph.medium.com/css/unbound.css"/><link data-rh="true" rel="author" href="https://medium.com/@arobertson_79988"/><link data-rh="true" rel="canonical" href="https://medium.com/mitre-attack/introducing-attack-v10-7743870b37e3"/><link data-rh="true" rel="alternate" href="android-app://com.medium.reader/https/medium.com/p/7743870b37e3"/><script data-rh="true" type="application/ld+json">{"@context":"http:\u002F\u002Fschema.org","@type":"NewsArticle","image":["https:\u002F\u002Fmiro.medium.com\u002Fv2\u002Fresize:fit:1200\u002F1*aghj7RR33HlT_i1FVYx_eQ.jpeg"],"url":"https:\u002F\u002Fmedium.com\u002Fmitre-attack\u002Fintroducing-attack-v10-7743870b37e3","dateCreated":"2021-10-21T15:50:37.317Z","datePublished":"2021-10-21T15:50:37.317Z","dateModified":"2022-01-04T21:21:34.086Z","headline":"Introducing ATT&CK v10: More Objects, Parity, and Features | MITRE ATT&CK®","name":"Introducing ATT&CK v10: More Objects, Parity, and Features | MITRE ATT&CK®","description":"As announced a couple of weeks ago, we’re back with the latest release and we’re thrilled to reveal all the updates and features waiting for you in ATT&CK v10. The v10 release includes the next…","identifier":"7743870b37e3","author":{"@type":"Person","name":"Amy L. Robertson","url":"https:\u002F\u002Fmedium.com\u002F@arobertson_79988"},"creator":["Amy L. Robertson"],"publisher":{"@type":"Organization","name":"MITRE ATT&CK®","url":"https:\u002F\u002Fmedium.com\u002Fmitre-attack","logo":{"@type":"ImageObject","width":291,"height":60,"url":"https:\u002F\u002Fmiro.medium.com\u002Fv2\u002Fresize:fit:582\u002F1*8epIYX1PfgfnVfDYfZ5loQ.png"}},"mainEntityOfPage":"https:\u002F\u002Fmedium.com\u002Fmitre-attack\u002Fintroducing-attack-v10-7743870b37e3"}</script><style type="text/css" data-fela-rehydration="531" data-fela-type="STATIC">html{box-sizing:border-box;-webkit-text-size-adjust:100%}*, *:before, *:after{box-sizing:inherit}body{margin:0;padding:0;text-rendering:optimizeLegibility;-webkit-font-smoothing:antialiased;color:rgba(0,0,0,0.8);position:relative;min-height:100vh}h1, h2, h3, h4, h5, h6, dl, dd, ol, ul, menu, figure, blockquote, p, pre, form{margin:0}menu, ol, ul{padding:0;list-style:none;list-style-image:none}main{display:block}a{color:inherit;text-decoration:none}a, button, input{-webkit-tap-highlight-color:transparent}img, svg{vertical-align:middle}button{background:transparent;overflow:visible}button, input, optgroup, select, textarea{margin:0}:root{--reach-tabs:1;--reach-menu-button:1}#speechify-root{font-family:Sohne, sans-serif}div[data-popper-reference-hidden="true"]{visibility:hidden;pointer-events:none}.grecaptcha-badge{visibility:hidden} /*XCode style (c) Angel Garcia <angelgarcia.mail@gmail.com>*/.hljs {background: #fff;color: black; }/* Gray DOCTYPE selectors like WebKit */ .xml .hljs-meta {color: #c0c0c0; }.hljs-comment, .hljs-quote {color: #007400; }.hljs-tag, .hljs-attribute, .hljs-keyword, .hljs-selector-tag, .hljs-literal, .hljs-name {color: #aa0d91; }.hljs-variable, .hljs-template-variable {color: #3F6E74; }.hljs-code, .hljs-string, .hljs-meta .hljs-string {color: #c41a16; }.hljs-regexp, .hljs-link {color: #0E0EFF; }.hljs-title, .hljs-symbol, .hljs-bullet, .hljs-number {color: #1c00cf; }.hljs-section, .hljs-meta {color: #643820; }.hljs-title.class_, .hljs-class .hljs-title, .hljs-type, .hljs-built_in, .hljs-params {color: #5c2699; }.hljs-attr {color: #836C28; }.hljs-subst {color: #000; }.hljs-formula {background-color: #eee;font-style: italic; }.hljs-addition {background-color: #baeeba; }.hljs-deletion {background-color: #ffc8bd; }.hljs-selector-id, .hljs-selector-class {color: #9b703f; }.hljs-doctag, .hljs-strong {font-weight: bold; }.hljs-emphasis {font-style: italic; } </style><style type="text/css" data-fela-rehydration="531" data-fela-type="KEYFRAME">@-webkit-keyframes k1{0%{opacity:0.8}50%{opacity:0.5}100%{opacity:0.8}}@-moz-keyframes k1{0%{opacity:0.8}50%{opacity:0.5}100%{opacity:0.8}}@keyframes k1{0%{opacity:0.8}50%{opacity:0.5}100%{opacity:0.8}}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE">.a{font-family:medium-content-sans-serif-font, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen, Ubuntu, Cantarell, "Open Sans", "Helvetica Neue", sans-serif}.b{font-weight:400}.c{background-color:rgba(255, 255, 255, 1)}.l{display:block}.m{position:sticky}.n{top:0}.o{z-index:500}.p{padding:0 24px}.q{align-items:center}.r{border-bottom:solid 1px #F2F2F2}.y{height:41px}.z{line-height:20px}.ab{display:flex}.ac{height:57px}.ae{flex:1 0 auto}.af{color:inherit}.ag{fill:inherit}.ah{font-size:inherit}.ai{border:inherit}.aj{font-family:inherit}.ak{letter-spacing:inherit}.al{font-weight:inherit}.am{padding:0}.an{margin:0}.ao{cursor:pointer}.ap:disabled{cursor:not-allowed}.aq:disabled{color:#6B6B6B}.ar:disabled{fill:#6B6B6B}.au{width:auto}.av path{fill:#242424}.aw{height:25px}.ax{margin-left:16px}.ay{border:none}.az{border-radius:20px}.ba{width:240px}.bb{background:#F9F9F9}.bc path{fill:#6B6B6B}.be{outline:none}.bf{font-family:sohne, "Helvetica Neue", Helvetica, Arial, sans-serif}.bg{font-size:14px}.bh{width:100%}.bi{padding:10px 20px 10px 0}.bj{background-color:transparent}.bk{color:#242424}.bl::placeholder{color:#6B6B6B}.bm{display:inline-block}.bn{margin-left:12px}.bo{margin-right:12px}.bp{border-radius:4px}.bq{margin-left:24px}.br{height:24px}.bx{background-color:#F9F9F9}.by{border-radius:50%}.bz{height:32px}.ca{width:32px}.cb{justify-content:center}.ch{max-width:680px}.ci{min-width:0}.cj{animation:k1 1.2s ease-in-out infinite}.ck{height:100vh}.cl{margin-bottom:16px}.cm{margin-top:48px}.cn{align-items:flex-start}.co{flex-direction:column}.cp{justify-content:space-between}.cq{margin-bottom:24px}.cw{width:80%}.cx{background-color:#F2F2F2}.dd{height:44px}.de{width:44px}.df{margin:auto 0}.dg{margin-bottom:4px}.dh{height:16px}.di{width:120px}.dj{width:80px}.dp{margin-bottom:8px}.dq{width:96%}.dr{width:98%}.ds{width:81%}.dt{margin-left:8px}.du{color:#6B6B6B}.dv{font-size:13px}.dw{height:100%}.ep{color:#FFFFFF}.eq{fill:#FFFFFF}.er{background:rgba(218, 78, 42, 1)}.es{border-color:rgba(218, 78, 42, 1)}.ew:disabled{cursor:inherit !important}.ex:disabled{opacity:0.3}.ey:disabled:hover{background:rgba(218, 78, 42, 1)}.ez:disabled:hover{border-color:rgba(218, 78, 42, 1)}.fa{border-radius:99em}.fb{border-width:1px}.fc{border-style:solid}.fd{box-sizing:border-box}.fe{text-decoration:none}.ff{text-align:center}.fi{margin-right:32px}.fj{position:relative}.fk{fill:#6B6B6B}.fn{background:transparent}.fo svg{margin-left:4px}.fp svg{fill:#6B6B6B}.fr{box-shadow:inset 0 0 0 1px rgba(0, 0, 0, 0.05)}.fs{position:absolute}.fz{margin:0 24px}.gd{background:rgba(255, 255, 255, 1)}.ge{border:1px solid #F2F2F2}.gf{box-shadow:0 1px 4px #F2F2F2}.gg{max-height:100vh}.gh{overflow-y:auto}.gi{left:0}.gj{top:calc(100vh + 100px)}.gk{bottom:calc(100vh + 100px)}.gl{width:10px}.gm{pointer-events:none}.gn{word-break:break-word}.go{word-wrap:break-word}.gp:after{display:block}.gq:after{content:""}.gr:after{clear:both}.gs{margin-left:auto}.gt{margin-right:auto}.gu{max-width:512px}.ha{clear:both}.hb{max-width:100%}.hc{height:auto}.hd{line-height:1.23}.he{letter-spacing:0}.hf{font-style:normal}.hg{font-weight:700}.il{align-items:baseline}.im{width:48px}.in{height:48px}.io{border:2px solid rgba(255, 255, 255, 1)}.ip{z-index:0}.iq{box-shadow:none}.ir{border:1px solid rgba(0, 0, 0, 0.05)}.is{margin-left:-12px}.it{width:28px}.iu{height:28px}.iv{z-index:1}.iw{width:24px}.ix{margin-bottom:2px}.iy{flex-wrap:nowrap}.iz{font-size:16px}.ja{line-height:24px}.jc{margin:0 8px}.jd{display:inline}.je{color:rgba(218, 78, 42, 1)}.jf{fill:rgba(218, 78, 42, 1)}.ji{flex:0 0 auto}.jl{flex-wrap:wrap}.jm{white-space:pre-wrap}.jn{margin-right:4px}.jo{overflow:hidden}.jp{max-height:20px}.jq{text-overflow:ellipsis}.jr{display:-webkit-box}.js{-webkit-line-clamp:1}.jt{-webkit-box-orient:vertical}.ju{word-break:break-all}.jw{padding-left:8px}.jx{padding-right:8px}.ky> *{flex-shrink:0}.kz{overflow-x:scroll}.la::-webkit-scrollbar{display:none}.lb{scrollbar-width:none}.lc{-ms-overflow-style:none}.ld{width:74px}.le{flex-direction:row}.lf{z-index:2}.li{-webkit-user-select:none}.lj{border:0}.lk{fill:rgba(117, 117, 117, 1)}.ln{outline:0}.lo{user-select:none}.lp> svg{pointer-events:none}.ly{cursor:progress}.lz{opacity:1}.ma{padding:4px 0}.md{margin-top:0px}.me{width:16px}.mg{display:inline-flex}.mm{padding:8px 2px}.mn svg{color:#6B6B6B}.ne{line-height:1.58}.nf{letter-spacing:-0.004em}.ng{font-family:source-serif-pro, Georgia, Cambria, "Times New Roman", Times, serif}.ob{margin-bottom:-0.46em}.oc{background:none}.od{text-decoration:underline}.oe{line-height:1.12}.of{letter-spacing:-0.022em}.og{font-weight:600}.pb{margin-bottom:-0.28em}.ph{max-width:982px}.po{cursor:zoom-in}.pp{z-index:auto}.pr{margin-top:10px}.ps{max-width:728px}.pv{max-width:962px}.pw{max-width:990px}.px{margin-bottom:26px}.py{margin-top:6px}.pz{margin-top:8px}.qa{margin-right:8px}.qb{padding:8px 16px}.qc{border-radius:100px}.qd{transition:background 300ms ease}.qf{white-space:nowrap}.qg{border-top:none}.qh{margin-bottom:50px}.qi{height:52px}.qj{max-height:52px}.qk{box-sizing:content-box}.ql{position:static}.qn{max-width:155px}.qt{margin-right:20px}.qu{margin-bottom:64px}.qv{margin-bottom:48px}.rj{border-radius:2px}.rl{height:64px}.rm{width:64px}.rn{align-self:flex-end}.ro{flex:1 1 auto}.ru{padding-right:4px}.rv{font-weight:500}.si{margin-top:16px}.sj{color:rgba(255, 255, 255, 1)}.sk{fill:rgba(255, 255, 255, 1)}.sl{background:rgba(25, 25, 25, 1)}.sm{border-color:rgba(25, 25, 25, 1)}.sp:disabled{opacity:0.1}.sq:disabled:hover{background:rgba(25, 25, 25, 1)}.sr:disabled:hover{border-color:rgba(25, 25, 25, 1)}.ss{margin-bottom:54px}.st{height:0px}.su{gap:18px}.sv{fill:rgba(61, 61, 61, 1)}.th{border-bottom:solid 1px #E5E5E5}.ti{margin-top:72px}.tj{padding:24px 0}.tk{margin-bottom:0px}.tl{margin-right:16px}.as:hover:not(:disabled){color:rgba(25, 25, 25, 1)}.at:hover:not(:disabled){fill:rgba(25, 25, 25, 1)}.et:hover{background:rgba(185, 70, 40, 1)}.eu:hover{border-color:rgba(185, 70, 40, 1)}.ev:hover{cursor:pointer}.fl:hover{color:#242424}.fm:hover{fill:#242424}.fq:hover svg{fill:#242424}.ft:hover{background-color:rgba(0, 0, 0, 0.1)}.jb:hover{text-decoration:underline}.jg:hover:not(:disabled){color:rgba(185, 70, 40, 1)}.jh:hover:not(:disabled){fill:rgba(185, 70, 40, 1)}.lm:hover{fill:rgba(8, 8, 8, 1)}.mb:hover{fill:#000000}.mc:hover p{color:#000000}.mf:hover{color:#000000}.mo:hover svg{color:#000000}.qe:hover{background-color:#F2F2F2}.rk:hover{background-color:none}.sn:hover{background:#000000}.so:hover{border-color:#242424}.sw:hover{fill:rgba(25, 25, 25, 1)}.bd:focus-within path{fill:#242424}.ll:focus{fill:rgba(8, 8, 8, 1)}.mp:focus svg{color:#000000}.pq:focus{transform:scale(1.01)}.lq:active{border-style:none}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE" media="all and (min-width: 1080px)">.d{display:none}.bw{width:64px}.cg{margin:0 64px}.cv{height:48px}.dc{margin-bottom:52px}.do{margin-bottom:48px}.ef{font-size:14px}.eg{line-height:20px}.em{font-size:13px}.eo{padding:5px 12px}.fh{display:flex}.fy{margin-bottom:50px}.gc{max-width:680px}.gz{margin-top:40px}.ib{font-size:42px}.ic{margin-top:1em}.id{margin-bottom:32px}.ie{line-height:52px}.if{letter-spacing:-0.011em}.ik{align-items:center}.kk{border-top:solid 1px #F2F2F2}.kl{border-bottom:solid 1px #F2F2F2}.km{margin:32px 0 0}.kn{padding:3px 8px}.kw> *{margin-right:24px}.kx> :last-child{margin-right:0}.lx{margin-top:0px}.ml{margin:0}.nx{font-size:20px}.ny{margin-top:2.14em}.nz{line-height:32px}.oa{letter-spacing:-0.003em}.ox{font-size:24px}.oy{margin-top:1.95em}.oz{line-height:30px}.pa{letter-spacing:-0.016em}.pg{margin-top:0.94em}.pm{margin-top:56px}.qs{display:inline-block}.qw{flex-direction:row}.qz{margin-bottom:0}.ra{margin-right:20px}.rp{max-width:500px}.sg{line-height:24px}.sh{letter-spacing:0}.tb{margin:40px 0 0}.tg{padding-top:72px}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE" media="all and (max-width: 1079.98px)">.e{display:none}.lw{margin-top:0px}.pt{margin-left:auto}.pu{text-align:center}.qr{display:inline-block}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE" media="all and (max-width: 903.98px)">.f{display:none}.lv{margin-top:0px}.qq{display:inline-block}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE" media="all and (max-width: 727.98px)">.g{display:none}.lt{margin-top:0px}.lu{margin-right:0px}.qp{display:inline-block}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE" media="all and (max-width: 551.98px)">.h{display:none}.s{display:flex}.t{justify-content:space-between}.bs{width:24px}.cc{margin:0 24px}.cr{height:40px}.cy{margin-bottom:44px}.dk{margin-bottom:32px}.dx{font-size:13px}.dy{line-height:20px}.eh{padding:0px 8px 1px}.fu{margin-bottom:2px}.gv{margin-top:32px}.hh{font-size:32px}.hi{margin-top:1.01em}.hj{margin-bottom:24px}.hk{line-height:38px}.hl{letter-spacing:-0.014em}.ig{align-items:flex-start}.jj{flex-direction:column}.jy{margin:24px -24px 0}.jz{padding:0}.ko> *{margin-right:8px}.kp> :last-child{margin-right:24px}.lg{margin-left:0px}.lr{margin-top:0px}.ls{margin-right:0px}.mh{margin:0}.mq{border:1px solid #F2F2F2}.mr{border-radius:99em}.ms{padding:0px 16px 0px 12px}.mt{height:38px}.mu{align-items:center}.mw svg{margin-right:8px}.nh{font-size:18px}.ni{margin-top:1.56em}.nj{line-height:28px}.nk{letter-spacing:-0.003em}.oh{font-size:20px}.oi{margin-top:1.2em}.oj{line-height:24px}.ok{letter-spacing:0}.pc{margin-top:0.67em}.pi{margin-top:40px}.qo{display:inline-block}.rh{margin-bottom:20px}.ri{margin-right:0}.rt{max-width:100%}.rw{font-size:24px}.rx{line-height:30px}.ry{letter-spacing:-0.016em}.sx{margin:32px 0 0}.tc{padding-top:48px}.mv:hover{border-color:#E5E5E5}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE" media="all and (min-width: 904px) and (max-width: 1079.98px)">.i{display:none}.bv{width:64px}.cf{margin:0 64px}.cu{height:48px}.db{margin-bottom:52px}.dn{margin-bottom:48px}.ed{font-size:14px}.ee{line-height:20px}.ek{font-size:13px}.el{padding:5px 12px}.fg{display:flex}.fx{margin-bottom:50px}.gb{max-width:680px}.gy{margin-top:40px}.hw{font-size:42px}.hx{margin-top:1em}.hy{margin-bottom:32px}.hz{line-height:52px}.ia{letter-spacing:-0.011em}.ij{align-items:center}.kg{border-top:solid 1px #F2F2F2}.kh{border-bottom:solid 1px #F2F2F2}.ki{margin:32px 0 0}.kj{padding:3px 8px}.ku> *{margin-right:24px}.kv> :last-child{margin-right:0}.mk{margin:0}.nt{font-size:20px}.nu{margin-top:2.14em}.nv{line-height:32px}.nw{letter-spacing:-0.003em}.ot{font-size:24px}.ou{margin-top:1.95em}.ov{line-height:30px}.ow{letter-spacing:-0.016em}.pf{margin-top:0.94em}.pl{margin-top:56px}.qx{flex-direction:row}.rb{margin-bottom:0}.rc{margin-right:20px}.rq{max-width:500px}.se{line-height:24px}.sf{letter-spacing:0}.ta{margin:40px 0 0}.tf{padding-top:72px}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE" media="all and (min-width: 728px) and (max-width: 903.98px)">.j{display:none}.w{display:flex}.x{justify-content:space-between}.bu{width:64px}.ce{margin:0 48px}.ct{height:48px}.da{margin-bottom:52px}.dm{margin-bottom:48px}.eb{font-size:13px}.ec{line-height:20px}.ej{padding:0px 8px 1px}.fw{margin-bottom:50px}.ga{max-width:680px}.gx{margin-top:40px}.hr{font-size:42px}.hs{margin-top:1em}.ht{margin-bottom:32px}.hu{line-height:52px}.hv{letter-spacing:-0.011em}.ii{align-items:center}.kc{border-top:solid 1px #F2F2F2}.kd{border-bottom:solid 1px #F2F2F2}.ke{margin:32px 0 0}.kf{padding:3px 8px}.ks> *{margin-right:24px}.kt> :last-child{margin-right:0}.mj{margin:0}.np{font-size:20px}.nq{margin-top:2.14em}.nr{line-height:32px}.ns{letter-spacing:-0.003em}.op{font-size:24px}.oq{margin-top:1.95em}.or{line-height:30px}.os{letter-spacing:-0.016em}.pe{margin-top:0.94em}.pk{margin-top:56px}.qy{flex-direction:row}.rd{margin-bottom:0}.re{margin-right:20px}.rr{max-width:500px}.sc{line-height:24px}.sd{letter-spacing:0}.sz{margin:40px 0 0}.te{padding-top:72px}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE" media="all and (min-width: 552px) and (max-width: 727.98px)">.k{display:none}.u{display:flex}.v{justify-content:space-between}.bt{width:24px}.cd{margin:0 24px}.cs{height:40px}.cz{margin-bottom:44px}.dl{margin-bottom:32px}.dz{font-size:13px}.ea{line-height:20px}.ei{padding:0px 8px 1px}.fv{margin-bottom:2px}.gw{margin-top:32px}.hm{font-size:32px}.hn{margin-top:1.01em}.ho{margin-bottom:24px}.hp{line-height:38px}.hq{letter-spacing:-0.014em}.ih{align-items:flex-start}.jk{flex-direction:column}.ka{margin:24px 0 0}.kb{padding:0}.kq> *{margin-right:8px}.kr> :last-child{margin-right:8px}.lh{margin-left:0px}.mi{margin:0}.mx{border:1px solid #F2F2F2}.my{border-radius:99em}.mz{padding:0px 16px 0px 12px}.na{height:38px}.nb{align-items:center}.nd svg{margin-right:8px}.nl{font-size:18px}.nm{margin-top:1.56em}.nn{line-height:28px}.no{letter-spacing:-0.003em}.ol{font-size:20px}.om{margin-top:1.2em}.on{line-height:24px}.oo{letter-spacing:0}.pd{margin-top:0.67em}.pj{margin-top:40px}.rf{margin-bottom:20px}.rg{margin-right:0}.rs{max-width:100%}.rz{font-size:24px}.sa{line-height:30px}.sb{letter-spacing:-0.016em}.sy{margin:32px 0 0}.td{padding-top:48px}.nc:hover{border-color:#E5E5E5}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE" media="print">.qm{display:none}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE" media="(orientation: landscape) and (max-width: 903.98px)">.jv{max-height:none}</style><style type="text/css" data-fela-rehydration="531" data-fela-type="RULE" media="(prefers-reduced-motion: no-preference)">.pn{transition:transform 300ms cubic-bezier(0.2, 0, 0.2, 1)}</style></head><body><div id="root"><div class="a b c"><div class="d e f g h i j k"></div><script>document.domain = document.domain;</script><div class="l c"><div class="l m n o c"><div class="p q r s t u v w x i d y z"><a class="du ag dv bf ak b am an ao ap aq ar as at s u w i d q dw z" href="https://rsci.app.link/?%24canonical_url=https%3A%2F%2Fmedium.com%2Fp%2F7743870b37e3&%7Efeature=LoOpenInAppButton&%7Echannel=ShowPostUnderCollection&source=---top_nav_layout_nav-----------------------------------------" rel="noopener follow">Open in app<svg xmlns="http://www.w3.org/2000/svg" width="10" height="10" fill="none" viewBox="0 0 10 10" class="dt"><path fill="currentColor" d="M.985 8.485a.375.375 0 1 0 .53.53zM8.75 1.25h.375A.375.375 0 0 0 8.75.875zM8.375 6.5a.375.375 0 1 0 .75 0zM3.5.875a.375.375 0 1 0 0 .75zm-1.985 8.14 7.5-7.5-.53-.53-7.5 7.5zm6.86-7.765V6.5h.75V1.25zM3.5 1.625h5.25v-.75H3.5z"></path></svg></a><div class="ab q"><p class="bf b dx dy dz ea eb ec ed ee ef eg du"><span><button class="bf b dx dy eh dz ea ei eb ec ej ek ee el em eg eo ep eq er es et eu ev ew ex ey ez fa fb fc fd bm fe ff" data-testid="headerSignUpButton">Sign up</button></span></p><div class="ax l"><p class="bf b dx dy dz ea eb ec ed ee ef eg du"><span><a class="af ag ah ai aj ak al am an ao ap aq ar as at" data-testid="headerSignInButton" rel="noopener follow" href="/m/signin?operation=login&redirect=https%3A%2F%2Fmedium.com%2Fmitre-attack%2Fintroducing-attack-v10-7743870b37e3&source=post_page---top_nav_layout_nav-----------------------global_nav------------------">Sign in</a></span></p></div></div></div><div class="p q r ab ac"><div class="ab q ae"><a class="af ag ah ai aj ak al am an ao ap aq ar as at ab" aria-label="Homepage" data-testid="headerMediumLogo" rel="noopener follow" href="/?source=---top_nav_layout_nav-----------------------------------------"><svg xmlns="http://www.w3.org/2000/svg" width="719" height="160" fill="none" viewBox="0 0 719 160" class="au av aw"><path fill="#242424" d="m174.104 9.734.215-.047V8.02H130.39L89.6 103.89 48.81 8.021H1.472v1.666l.212.047c8.018 1.81 12.09 4.509 12.09 14.242V137.93c0 9.734-4.087 12.433-12.106 14.243l-.212.047v1.671h32.118v-1.665l-.213-.048c-8.018-1.809-12.089-4.509-12.089-14.242V30.586l52.399 123.305h2.972l53.925-126.743V140.75c-.687 7.688-4.721 10.062-11.982 11.701l-.215.05v1.652h55.948v-1.652l-.215-.05c-7.269-1.639-11.4-4.013-12.087-11.701l-.037-116.774h.037c0-9.733 4.071-12.432 12.087-14.242m25.555 75.488c.915-20.474 8.268-35.252 20.606-35.507 3.806.063 6.998 1.312 9.479 3.714 5.272 5.118 7.751 15.812 7.368 31.793zm-.553 5.77h65.573v-.275c-.186-15.656-4.721-27.834-13.466-36.196-7.559-7.227-18.751-11.203-30.507-11.203h-.263c-6.101 0-13.584 1.48-18.909 4.16-6.061 2.807-11.407 7.003-15.855 12.511-7.161 8.874-11.499 20.866-12.554 34.343q-.05.606-.092 1.212a50 50 0 0 0-.065 1.151 85.807 85.807 0 0 0-.094 5.689c.71 30.524 17.198 54.917 46.483 54.917 25.705 0 40.675-18.791 44.407-44.013l-1.886-.664c-6.557 13.556-18.334 21.771-31.738 20.769-18.297-1.369-32.314-19.922-31.042-42.395m139.722 41.359c-2.151 5.101-6.639 7.908-12.653 7.908s-11.513-4.129-15.418-11.63c-4.197-8.053-6.405-19.436-6.405-32.92 0-28.067 8.729-46.22 22.24-46.22 5.657 0 10.111 2.807 12.236 7.704zm43.499 20.008c-8.019-1.897-12.089-4.722-12.089-14.951V1.309l-48.716 14.353v1.757l.299-.024c6.72-.543 11.278.386 13.925 2.83 2.072 1.915 3.082 4.853 3.082 8.987v18.66c-4.803-3.067-10.516-4.56-17.448-4.56-14.059 0-26.909 5.92-36.176 16.672-9.66 11.205-14.767 26.518-14.767 44.278-.003 31.72 15.612 53.039 38.851 53.039 13.595 0 24.533-7.449 29.54-20.013v16.865h43.711v-1.746zM424.1 19.819c0-9.904-7.468-17.374-17.375-17.374-9.859 0-17.573 7.632-17.573 17.374s7.721 17.374 17.573 17.374c9.907 0 17.375-7.47 17.375-17.374m11.499 132.546c-8.019-1.897-12.089-4.722-12.089-14.951h-.035V43.635l-43.714 12.551v1.705l.263.024c9.458.842 12.047 4.1 12.047 15.152v81.086h43.751v-1.746zm112.013 0c-8.018-1.897-12.089-4.722-12.089-14.951V43.635l-41.621 12.137v1.71l.246.026c7.733.813 9.967 4.257 9.967 15.36v59.279c-2.578 5.102-7.415 8.131-13.274 8.336-9.503 0-14.736-6.419-14.736-18.073V43.638l-43.714 12.55v1.703l.262.024c9.459.84 12.05 4.097 12.05 15.152v50.17a56.3 56.3 0 0 0 .91 10.444l.787 3.423c3.701 13.262 13.398 20.197 28.59 20.197 12.868 0 24.147-7.966 29.115-20.43v17.311h43.714v-1.747zm169.818 1.788v-1.749l-.213-.05c-8.7-2.006-12.089-5.789-12.089-13.49v-63.79c0-19.89-11.171-31.761-29.883-31.761-13.64 0-25.141 7.882-29.569 20.16-3.517-13.01-13.639-20.16-28.606-20.16-13.146 0-23.449 6.938-27.869 18.657V43.643L545.487 55.68v1.715l.263.024c9.345.829 12.047 4.181 12.047 14.95v81.784h40.787v-1.746l-.215-.053c-6.941-1.631-9.181-4.606-9.181-12.239V66.998c1.836-4.289 5.537-9.37 12.853-9.37 9.086 0 13.692 6.296 13.692 18.697v77.828h40.797v-1.746l-.215-.053c-6.94-1.631-9.18-4.606-9.18-12.239V75.066a42 42 0 0 0-.578-7.26c1.947-4.661 5.86-10.177 13.475-10.177 9.214 0 13.691 6.114 13.691 18.696v77.828z"></path></svg></a><div class="ax h"><div class="ab ay az ba bb q bc bd"><div class="bm" aria-hidden="false" aria-describedby="searchResults" aria-labelledby="searchResults"></div><div class="bn bo ab"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" viewBox="0 0 24 24"><path fill="currentColor" fill-rule="evenodd" d="M4.092 11.06a6.95 6.95 0 1 1 13.9 0 6.95 6.95 0 0 1-13.9 0m6.95-8.05a8.05 8.05 0 1 0 5.13 14.26l3.75 3.75a.56.56 0 1 0 .79-.79l-3.73-3.73A8.05 8.05 0 0 0 11.042 3z" clip-rule="evenodd"></path></svg></div><input role="combobox" aria-controls="searchResults" aria-expanded="false" aria-label="search" data-testid="headerSearchInput" tabindex="0" class="ay be bf bg z bh bi bj bk bl" placeholder="Search" value=""/></div></div></div><div class="h k w fg fh"><div class="fi ab"><span><a class="af ag ah ai aj ak al am an ao ap aq ar as at" data-testid="headerWriteButton" rel="noopener follow" href="/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---top_nav_layout_nav-----------------------new_post_topnav------------------"><div class="bf b bg z du fj fk ab q fl fm"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" viewBox="0 0 24 24" aria-label="Write"><path fill="currentColor" d="M14 4a.5.5 0 0 0 0-1zm7 6a.5.5 0 0 0-1 0zm-7-7H4v1h10zM3 4v16h1V4zm1 17h16v-1H4zm17-1V10h-1v10zm-1 1a1 1 0 0 0 1-1h-1zM3 20a1 1 0 0 0 1 1v-1zM4 3a1 1 0 0 0-1 1h1z"></path><path stroke="currentColor" d="m17.5 4.5-8.458 8.458a.25.25 0 0 0-.06.098l-.824 2.47a.25.25 0 0 0 .316.316l2.47-.823a.25.25 0 0 0 .098-.06L19.5 6.5m-2-2 2.323-2.323a.25.25 0 0 1 .354 0l1.646 1.646a.25.25 0 0 1 0 .354L19.5 6.5m-2-2 2 2"></path></svg><div class="dt l">Write</div></div></a></span></div></div><div class="k j i d"><div class="fi ab"><a class="af ag ah ai aj ak al am an ao ap aq ar as at" data-testid="headerSearchButton" rel="noopener follow" href="/search?source=---top_nav_layout_nav-----------------------------------------"><div class="bf b bg z du fj fk ab q fl fm"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" viewBox="0 0 24 24" aria-label="Search"><path fill="currentColor" fill-rule="evenodd" d="M4.092 11.06a6.95 6.95 0 1 1 13.9 0 6.95 6.95 0 0 1-13.9 0m6.95-8.05a8.05 8.05 0 1 0 5.13 14.26l3.75 3.75a.56.56 0 1 0 .79-.79l-3.73-3.73A8.05 8.05 0 0 0 11.042 3z" clip-rule="evenodd"></path></svg></div></a></div></div><div class="fi h k j"><div class="ab q"><p class="bf b dx dy dz ea eb ec ed ee ef eg du"><span><button class="bf b dx dy eh dz ea ei eb ec ej ek ee el em eg eo ep eq er es et eu ev ew ex ey ez fa fb fc fd bm fe ff" data-testid="headerSignUpButton">Sign up</button></span></p><div class="ax l"><p class="bf b dx dy dz ea eb ec ed ee ef eg du"><span><a class="af ag ah ai aj ak al am an ao ap aq ar as at" data-testid="headerSignInButton" rel="noopener follow" href="/m/signin?operation=login&redirect=https%3A%2F%2Fmedium.com%2Fmitre-attack%2Fintroducing-attack-v10-7743870b37e3&source=post_page---top_nav_layout_nav-----------------------global_nav------------------">Sign in</a></span></p></div></div></div><div class="l" aria-hidden="false"><button class="ay fn am ab q ao fo fp fq" aria-label="user options menu" data-testid="headerUserIcon"><div class="l fj"><img alt="" class="l fd by bz ca cx" src="https://miro.medium.com/v2/resize:fill:64:64/1*dmbNkD5D-u45r44go_cf0g.png" width="32" height="32" loading="lazy" role="presentation"/><div class="fr by l bz ca fs n ay ft"></div></div></button></div></div></div><div class="l"><div class="fu fv fw fx fy l"><div class="ab cb"><div class="ci bh fz ga gb gc"></div></div><article><div class="l"><div class="l"><span class="l"></span><section><div><div class="fs gi gj gk gl gm"></div><div class="gn go gp gq gr"><div class="ab cb"><div class="ci bh fz ga gb gc"><figure class="gv gw gx gy gz ha gs gt paragraph-image"><div class="gs gt gu"><picture><source srcSet="https://miro.medium.com/v2/resize:fit:640/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 640w, https://miro.medium.com/v2/resize:fit:720/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 720w, https://miro.medium.com/v2/resize:fit:750/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 750w, https://miro.medium.com/v2/resize:fit:786/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 786w, https://miro.medium.com/v2/resize:fit:828/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 828w, https://miro.medium.com/v2/resize:fit:1100/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 1100w, https://miro.medium.com/v2/resize:fit:1024/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 1024w" sizes="(min-resolution: 4dppx) and (max-width: 700px) 50vw, (-webkit-min-device-pixel-ratio: 4) and (max-width: 700px) 50vw, (min-resolution: 3dppx) and (max-width: 700px) 67vw, (-webkit-min-device-pixel-ratio: 3) and (max-width: 700px) 65vw, (min-resolution: 2.5dppx) and (max-width: 700px) 80vw, (-webkit-min-device-pixel-ratio: 2.5) and (max-width: 700px) 80vw, (min-resolution: 2dppx) and (max-width: 700px) 100vw, (-webkit-min-device-pixel-ratio: 2) and (max-width: 700px) 100vw, 512px" type="image/webp"/><source data-testid="og" srcSet="https://miro.medium.com/v2/resize:fit:640/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 640w, https://miro.medium.com/v2/resize:fit:720/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 720w, https://miro.medium.com/v2/resize:fit:750/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 750w, https://miro.medium.com/v2/resize:fit:786/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 786w, https://miro.medium.com/v2/resize:fit:828/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 828w, https://miro.medium.com/v2/resize:fit:1100/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 1100w, https://miro.medium.com/v2/resize:fit:1024/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 1024w" sizes="(min-resolution: 4dppx) and (max-width: 700px) 50vw, (-webkit-min-device-pixel-ratio: 4) and (max-width: 700px) 50vw, (min-resolution: 3dppx) and (max-width: 700px) 67vw, (-webkit-min-device-pixel-ratio: 3) and (max-width: 700px) 65vw, (min-resolution: 2.5dppx) and (max-width: 700px) 80vw, (-webkit-min-device-pixel-ratio: 2.5) and (max-width: 700px) 80vw, (min-resolution: 2dppx) and (max-width: 700px) 100vw, (-webkit-min-device-pixel-ratio: 2) and (max-width: 700px) 100vw, 512px"/><img alt="" class="bh hb hc c" width="512" height="312" loading="eager" role="presentation"/></picture></div></figure><div><h1 id="9221" class="pw-post-title hd he hf bf hg hh hi hj hk hl hm hn ho hp hq hr hs ht hu hv hw hx hy hz ia ib ic id ie if bk" data-testid="storyTitle"><strong class="al">Introducing ATT&CK v10: More Objects, Parity, and Features</strong></h1><div><div class="speechify-ignore ab cp"><div class="speechify-ignore bh l"><div class="ig ih ii ij ik ab"><div><div class="ab il"><div><div class="bm" aria-hidden="false"><a rel="noopener follow" href="/@arobertson_79988?source=post_page---byline--7743870b37e3---------------------------------------"><div class="l im in by io ip"><div class="l fj"><img alt="Amy L. Robertson" class="l fd by dd de cx" src="https://miro.medium.com/v2/resize:fill:88:88/1*HSqNMSnjesj-UnJGDPJi7g.jpeg" width="44" height="44" loading="lazy" data-testid="authorPhoto"/><div class="iq by l dd de fs n ir ft"></div></div></div></a></div></div><div class="is ab fj"><div><div class="bm" aria-hidden="false"><a href="https://medium.com/mitre-attack?source=post_page---byline--7743870b37e3---------------------------------------" rel="noopener follow"><div class="l it iu by io iv"><div class="l fj"><img alt="MITRE ATT&CK®" class="l fd by br iw cx" src="https://miro.medium.com/v2/resize:fill:48:48/1*Y6LKGEIzmF96lVHkv_RS9A.png" width="24" height="24" loading="lazy" data-testid="publicationPhoto"/><div class="iq by l br iw fs n ir ft"></div></div></div></a></div></div></div></div></div><div class="bn bh l"><div class="ab"><div style="flex:1"><span class="bf b bg z bk"><div class="ix ab q"><div class="ab q iy"><div class="ab q"><div><div class="bm" aria-hidden="false"><p class="bf b iz ja bk"><a class="af ag ah ai aj ak al am an ao ap aq ar jb" data-testid="authorName" rel="noopener follow" href="/@arobertson_79988?source=post_page---byline--7743870b37e3---------------------------------------">Amy L. Robertson</a></p></div></div></div><span class="jc jd" aria-hidden="true"><span class="bf b bg z du">·</span></span><p class="bf b iz ja du"><span><a class="je jf ah ai aj ak al am an ao ap aq ar ex jg jh" rel="noopener follow" href="/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fsubscribe%2Fuser%2F13b16fa8065d&operation=register&redirect=https%3A%2F%2Fmedium.com%2Fmitre-attack%2Fintroducing-attack-v10-7743870b37e3&user=Amy+L.+Robertson&userId=13b16fa8065d&source=post_page-13b16fa8065d--byline--7743870b37e3---------------------post_header------------------">Follow</a></span></p></div></div></span></div></div><div class="l ji"><span class="bf b bg z du"><div class="ab cn jj jk jl"><div class="fu fv ab"><div class="bf b bg z du ab jm"><span class="jn l ji">Published in</span><div><div class="l" aria-hidden="false"><a class="af ag ah ai aj ak al am an ao ap aq ar jb ab q" data-testid="publicationName" href="https://medium.com/mitre-attack?source=post_page---byline--7743870b37e3---------------------------------------" rel="noopener follow"><p class="bf b bg z jo jp jq jr js jt ju jv bk">MITRE ATT&CK®</p></a></div></div></div><div class="h k"><span class="jc jd" aria-hidden="true"><span class="bf b bg z du">·</span></span></div></div><span class="bf b bg z du"><div class="ab ae"><span data-testid="storyReadTime">6 min read</span><div class="jw jx l" aria-hidden="true"><span class="l" aria-hidden="true"><span class="bf b bg z du">·</span></span></div><span data-testid="storyPublishDate">Oct 21, 2021</span></div></span></div></span></div></div></div><div class="ab cp jy jz ka kb kc kd ke kf kg kh ki kj kk kl km kn"><div class="h k w fg fh q"><div class="ld l"><div class="ab q le lf"><div class="pw-multi-vote-icon fj jn lg lh li"><span><a class="af ag ah ai aj ak al am an ao ap aq ar as at" data-testid="headerClapButton" rel="noopener follow" href="/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fmitre-attack%2F7743870b37e3&operation=register&redirect=https%3A%2F%2Fmedium.com%2Fmitre-attack%2Fintroducing-attack-v10-7743870b37e3&user=Amy+L.+Robertson&userId=13b16fa8065d&source=---header_actions--7743870b37e3---------------------clap_footer------------------"><div><div class="bm" aria-hidden="false"><div class="lj ao lk ll lm ln am lo lp lq li"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-label="clap"><path fill-rule="evenodd" d="M11.37.828 12 3.282l.63-2.454zM13.916 3.953l1.523-2.112-1.184-.39zM8.589 1.84l1.522 2.112-.337-2.501zM18.523 18.92c-.86.86-1.75 1.246-2.62 1.33a6 6 0 0 0 .407-.372c2.388-2.389 2.86-4.951 1.399-7.623l-.912-1.603-.79-1.672c-.26-.56-.194-.98.203-1.288a.7.7 0 0 1 .546-.132c.283.046.546.231.728.5l2.363 4.157c.976 1.624 1.141 4.237-1.324 6.702m-10.999-.438L3.37 14.328a.828.828 0 0 1 .585-1.408.83.83 0 0 1 .585.242l2.158 2.157a.365.365 0 0 0 .516-.516l-2.157-2.158-1.449-1.449a.826.826 0 0 1 1.167-1.17l3.438 3.44a.363.363 0 0 0 .516 0 .364.364 0 0 0 0-.516L5.293 9.513l-.97-.97a.826.826 0 0 1 0-1.166.84.84 0 0 1 1.167 0l.97.968 3.437 3.436a.36.36 0 0 0 .517 0 .366.366 0 0 0 0-.516L6.977 7.83a.82.82 0 0 1-.241-.584.82.82 0 0 1 .824-.826c.219 0 .43.087.584.242l5.787 5.787a.366.366 0 0 0 .587-.415l-1.117-2.363c-.26-.56-.194-.98.204-1.289a.7.7 0 0 1 .546-.132c.283.046.545.232.727.501l2.193 3.86c1.302 2.38.883 4.59-1.277 6.75-1.156 1.156-2.602 1.627-4.19 1.367-1.418-.236-2.866-1.033-4.079-2.246M10.75 5.971l2.12 2.12c-.41.502-.465 1.17-.128 1.89l.22.465-3.523-3.523a.8.8 0 0 1-.097-.368c0-.22.086-.428.241-.584a.847.847 0 0 1 1.167 0m7.355 1.705c-.31-.461-.746-.758-1.23-.837a1.44 1.44 0 0 0-1.11.275c-.312.24-.505.543-.59.881a1.74 1.74 0 0 0-.906-.465 1.47 1.47 0 0 0-.82.106l-2.182-2.182a1.56 1.56 0 0 0-2.2 0 1.54 1.54 0 0 0-.396.701 1.56 1.56 0 0 0-2.21-.01 1.55 1.55 0 0 0-.416.753c-.624-.624-1.649-.624-2.237-.037a1.557 1.557 0 0 0 0 2.2c-.239.1-.501.238-.715.453a1.56 1.56 0 0 0 0 2.2l.516.515a1.556 1.556 0 0 0-.753 2.615L7.01 19c1.32 1.319 2.909 2.189 4.475 2.449q.482.08.971.08c.85 0 1.653-.198 2.393-.579.231.033.46.054.686.054 1.266 0 2.457-.52 3.505-1.567 2.763-2.763 2.552-5.734 1.439-7.586z" clip-rule="evenodd"></path></svg></div></div></div></a></span></div><div class="pw-multi-vote-count l lr ls lt lu lv lw lx"><p class="bf b dv z du"><span class="ly">--</span></p></div></div></div><div><div class="bm" aria-hidden="false"><button class="ao lj lz ma ab q fk mb mc" aria-label="responses"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" class="md"><path d="M18.006 16.803c1.533-1.456 2.234-3.325 2.234-5.321C20.24 7.357 16.709 4 12.191 4S4 7.357 4 11.482c0 4.126 3.674 7.482 8.191 7.482.817 0 1.622-.111 2.393-.327.231.2.48.391.744.559 1.06.693 2.203 1.044 3.399 1.044.224-.008.4-.112.486-.287a.49.49 0 0 0-.042-.518c-.495-.67-.845-1.364-1.04-2.057a4 4 0 0 1-.125-.598zm-3.122 1.055-.067-.223-.315.096a8 8 0 0 1-2.311.338c-4.023 0-7.292-2.955-7.292-6.587 0-3.633 3.269-6.588 7.292-6.588 4.014 0 7.112 2.958 7.112 6.593 0 1.794-.608 3.469-2.027 4.72l-.195.168v.255c0 .056 0 .151.016.295.025.231.081.478.154.733.154.558.398 1.117.722 1.659a5.3 5.3 0 0 1-2.165-.845c-.276-.176-.714-.383-.941-.59z"></path></svg></button></div></div></div><div class="ab q ko kp kq kr ks kt ku kv kw kx ky kz la lb lc"><div class="me k j i d"></div><div class="h k"><div><div class="bm" aria-hidden="false"><span><a class="af ag ah ai aj ak al am an ao ap aq ar as at" data-testid="headerBookmarkButton" rel="noopener follow" href="/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F7743870b37e3&operation=register&redirect=https%3A%2F%2Fmedium.com%2Fmitre-attack%2Fintroducing-attack-v10-7743870b37e3&source=---header_actions--7743870b37e3---------------------bookmark_footer------------------"><svg xmlns="http://www.w3.org/2000/svg" width="25" height="25" fill="none" viewBox="0 0 25 25" class="du mf" aria-label="Add to list bookmark button"><path fill="currentColor" d="M18 2.5a.5.5 0 0 1 1 0V5h2.5a.5.5 0 0 1 0 1H19v2.5a.5.5 0 1 1-1 0V6h-2.5a.5.5 0 0 1 0-1H18zM7 7a1 1 0 0 1 1-1h3.5a.5.5 0 0 0 0-1H8a2 2 0 0 0-2 2v14a.5.5 0 0 0 .805.396L12.5 17l5.695 4.396A.5.5 0 0 0 19 21v-8.5a.5.5 0 0 0-1 0v7.485l-5.195-4.012a.5.5 0 0 0-.61 0L7 19.985z"></path></svg></a></span></div></div></div><div class="fd mg cn"><div class="l ae"><div class="ab cb"><div class="mh mi mj mk ml hb ci bh"><div class="ab"><div class="bm" aria-hidden="false"><div><div class="bm" aria-hidden="false"><button aria-label="Listen" data-testid="audioPlayButton" class="af fk ah ai aj ak al mm an ao ap ex mn mo mc mp mq mr ms mt s mu mv mw mx my mz na u nb nc nd"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" viewBox="0 0 24 24"><path fill="currentColor" fill-rule="evenodd" d="M3 12a9 9 0 1 1 18 0 9 9 0 0 1-18 0m9-10C6.477 2 2 6.477 2 12s4.477 10 10 10 10-4.477 10-10S17.523 2 12 2m3.376 10.416-4.599 3.066a.5.5 0 0 1-.777-.416V8.934a.5.5 0 0 1 .777-.416l4.599 3.066a.5.5 0 0 1 0 .832" clip-rule="evenodd"></path></svg><div class="j i d"><p class="bf b bg z du">Listen</p></div></button></div></div></div></div></div></div></div></div><div class="bm" aria-hidden="false" aria-describedby="postFooterSocialMenu" aria-labelledby="postFooterSocialMenu"><div><div class="bm" aria-hidden="false"><button aria-controls="postFooterSocialMenu" aria-expanded="false" aria-label="Share Post" data-testid="headerSocialShareButton" class="af fk ah ai aj ak al mm an ao ap ex mn mo mc mp mq mr ms mt s mu mv mw mx my mz na u nb nc nd"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" viewBox="0 0 24 24"><path fill="currentColor" fill-rule="evenodd" d="M15.218 4.931a.4.4 0 0 1-.118.132l.012.006a.45.45 0 0 1-.292.074.5.5 0 0 1-.3-.13l-2.02-2.02v7.07c0 .28-.23.5-.5.5s-.5-.22-.5-.5v-7.04l-2 2a.45.45 0 0 1-.57.04h-.02a.4.4 0 0 1-.16-.3.4.4 0 0 1 .1-.32l2.8-2.8a.5.5 0 0 1 .7 0l2.8 2.79a.42.42 0 0 1 .068.498m-.106.138.008.004v-.01zM16 7.063h1.5a2 2 0 0 1 2 2v10a2 2 0 0 1-2 2h-11c-1.1 0-2-.9-2-2v-10a2 2 0 0 1 2-2H8a.5.5 0 0 1 .35.15.5.5 0 0 1 .15.35.5.5 0 0 1-.15.35.5.5 0 0 1-.35.15H6.4c-.5 0-.9.4-.9.9v10.2a.9.9 0 0 0 .9.9h11.2c.5 0 .9-.4.9-.9v-10.2c0-.5-.4-.9-.9-.9H16a.5.5 0 0 1 0-1" clip-rule="evenodd"></path></svg><div class="j i d"><p class="bf b bg z du">Share</p></div></button></div></div></div></div></div></div></div></div></div><p id="cda8" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">By <span class="jd"><span class="jd" aria-hidden="false"><a class="oc je fe" href="https://medium.com/u/13b16fa8065d?source=post_page---user_mention--7743870b37e3---------------------------------------" rel="noopener" target="_blank">Amy L. Robertson</a></span></span> (MITRE), <span class="jd"><span class="jd" aria-hidden="false"><a class="oc je fe" href="https://medium.com/u/35dc9bd08e61?source=post_page---user_mention--7743870b37e3---------------------------------------" rel="noopener" target="_blank">Alexia Crumpton</a></span></span> (MITRE), and <span class="jd"><span class="jd" aria-hidden="false"><a class="oc je fe" href="https://medium.com/u/d182dc9a9096?source=post_page---user_mention--7743870b37e3---------------------------------------" rel="noopener" target="_blank">Chris Ante</a></span></span> (MITRE)</p><p id="6eeb" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">As <a class="af od" href="https://twitter.com/MITREattack/status/1445060354703245321" rel="noopener ugc nofollow" target="_blank">announced</a> a couple of weeks ago, we’re back with the latest release and we’re thrilled to reveal all the updates and features waiting for you in ATT&CK v10. The v10 release includes the next episode in our data sources saga, as well as new content and our usual enhancements to (sub-)Techniques, Groups, and Software across Enterprise, Mobile and ICS, which you can find more details about on our <a class="af od" href="https://attack.mitre.org/resources/updates/updates-october-2021/" rel="noopener ugc nofollow" target="_blank">release notes</a>.</p><h1 id="7de2" class="oe of hf bf og oh oi oj ok ol om on oo op oq or os ot ou ov ow ox oy oz pa pb bk">Making Sense of the New Data Sources: Episode II</h1><p id="6eb0" class="pw-post-body-paragraph ne nf hf ng b nh pc nj nk nl pd nn no np pe nr ns nt pf nv nw nx pg nz oa ob gn bk">In ATT&CK v9, we launched the <a class="af od" rel="noopener" href="/mitre-attack/attack-april-2021-release-39accaf23c81">new form of data sources</a> which featured an updated structure for the data source names (<strong class="ng hg">Data Source: Data Component), reflecting</strong></p><p id="5771" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">“What is the subject/topic of the collected data (file, process, network traffic, etc.)?” <strong class="ng hg">:</strong></p><p id="f4e2" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">“What specific values/properties are needed in order to detect adversary behaviors?”</p><p id="3a22" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">These updates were linked to Yaml files in <a class="af od" href="https://github.com/mitre-attack/attack-datasources" rel="noopener ugc nofollow" target="_blank">GitHub</a>, but weren’t fully integrated into the rest of ATT&CK yet. Our updated content in ATT&CK v10 aggregates this information about data sources, while structuring them as the new <a class="af od" href="https://attack.mitre.org/datasources/" rel="noopener ugc nofollow" target="_blank">ATT&CK data source objects</a> (somewhat similar to how <a class="af od" href="https://attack.mitre.org/mitigations/enterprise/" rel="noopener ugc nofollow" target="_blank">Mitigations</a> are reflected).</p><p id="645c" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">The data source object features the name of the data source as well as key details and metadata, including an ID, a definition, where it can be collected (collection layer), what platform(s) it can be found on, and the data components highlighting relevant values/properties that comprise the data source. Featured below is an example of a data source page in ATT&CK v10.</p><figure class="pi pj pk pl pm ha gs gt paragraph-image"><div role="button" tabindex="0" class="pn po fj pp bh pq"><div class="gs gt ph"><picture><source srcSet="https://miro.medium.com/v2/resize:fit:640/format:webp/1*LLlBzThlt8No2Wvxh8R9Ew.png 640w, https://miro.medium.com/v2/resize:fit:720/format:webp/1*LLlBzThlt8No2Wvxh8R9Ew.png 720w, https://miro.medium.com/v2/resize:fit:750/format:webp/1*LLlBzThlt8No2Wvxh8R9Ew.png 750w, https://miro.medium.com/v2/resize:fit:786/format:webp/1*LLlBzThlt8No2Wvxh8R9Ew.png 786w, https://miro.medium.com/v2/resize:fit:828/format:webp/1*LLlBzThlt8No2Wvxh8R9Ew.png 828w, https://miro.medium.com/v2/resize:fit:1100/format:webp/1*LLlBzThlt8No2Wvxh8R9Ew.png 1100w, https://miro.medium.com/v2/resize:fit:1400/format:webp/1*LLlBzThlt8No2Wvxh8R9Ew.png 1400w" sizes="(min-resolution: 4dppx) and (max-width: 700px) 50vw, (-webkit-min-device-pixel-ratio: 4) and (max-width: 700px) 50vw, (min-resolution: 3dppx) and (max-width: 700px) 67vw, (-webkit-min-device-pixel-ratio: 3) and (max-width: 700px) 65vw, (min-resolution: 2.5dppx) and (max-width: 700px) 80vw, (-webkit-min-device-pixel-ratio: 2.5) and (max-width: 700px) 80vw, (min-resolution: 2dppx) and (max-width: 700px) 100vw, (-webkit-min-device-pixel-ratio: 2) and (max-width: 700px) 100vw, 700px" type="image/webp"/><source data-testid="og" srcSet="https://miro.medium.com/v2/resize:fit:640/1*LLlBzThlt8No2Wvxh8R9Ew.png 640w, https://miro.medium.com/v2/resize:fit:720/1*LLlBzThlt8No2Wvxh8R9Ew.png 720w, https://miro.medium.com/v2/resize:fit:750/1*LLlBzThlt8No2Wvxh8R9Ew.png 750w, https://miro.medium.com/v2/resize:fit:786/1*LLlBzThlt8No2Wvxh8R9Ew.png 786w, https://miro.medium.com/v2/resize:fit:828/1*LLlBzThlt8No2Wvxh8R9Ew.png 828w, https://miro.medium.com/v2/resize:fit:1100/1*LLlBzThlt8No2Wvxh8R9Ew.png 1100w, https://miro.medium.com/v2/resize:fit:1400/1*LLlBzThlt8No2Wvxh8R9Ew.png 1400w" sizes="(min-resolution: 4dppx) and (max-width: 700px) 50vw, (-webkit-min-device-pixel-ratio: 4) and (max-width: 700px) 50vw, (min-resolution: 3dppx) and (max-width: 700px) 67vw, (-webkit-min-device-pixel-ratio: 3) and (max-width: 700px) 65vw, (min-resolution: 2.5dppx) and (max-width: 700px) 80vw, (-webkit-min-device-pixel-ratio: 2.5) and (max-width: 700px) 80vw, (min-resolution: 2dppx) and (max-width: 700px) 100vw, (-webkit-min-device-pixel-ratio: 2) and (max-width: 700px) 100vw, 700px"/><img alt="" class="bh hb hc c" width="700" height="368" loading="lazy" role="presentation"/></picture></div></div><figcaption class="pr ff ps gs gt pt pu bf b bg z du">Figure 1: Network Traffic Data Source Page</figcaption></figure><p id="03f6" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">Data Components are also listed below, each highlighting mappings to the various (sub-)techniques that may be detected with that particular data. On individual (sub-)techniques, data sources and components have been relocated from the metadata box at the top of the page to be collocated with Detection content.</p><figure class="pi pj pk pl pm ha gs gt paragraph-image"><div role="button" tabindex="0" class="pn po fj pp bh pq"><div class="gs gt pv"><picture><source srcSet="https://miro.medium.com/v2/resize:fit:640/format:webp/1*lGqNBMvtaXAXWP1K2jQO8A.png 640w, https://miro.medium.com/v2/resize:fit:720/format:webp/1*lGqNBMvtaXAXWP1K2jQO8A.png 720w, https://miro.medium.com/v2/resize:fit:750/format:webp/1*lGqNBMvtaXAXWP1K2jQO8A.png 750w, https://miro.medium.com/v2/resize:fit:786/format:webp/1*lGqNBMvtaXAXWP1K2jQO8A.png 786w, https://miro.medium.com/v2/resize:fit:828/format:webp/1*lGqNBMvtaXAXWP1K2jQO8A.png 828w, https://miro.medium.com/v2/resize:fit:1100/format:webp/1*lGqNBMvtaXAXWP1K2jQO8A.png 1100w, https://miro.medium.com/v2/resize:fit:1400/format:webp/1*lGqNBMvtaXAXWP1K2jQO8A.png 1400w" sizes="(min-resolution: 4dppx) and (max-width: 700px) 50vw, (-webkit-min-device-pixel-ratio: 4) and (max-width: 700px) 50vw, (min-resolution: 3dppx) and (max-width: 700px) 67vw, (-webkit-min-device-pixel-ratio: 3) and (max-width: 700px) 65vw, (min-resolution: 2.5dppx) and (max-width: 700px) 80vw, (-webkit-min-device-pixel-ratio: 2.5) and (max-width: 700px) 80vw, (min-resolution: 2dppx) and (max-width: 700px) 100vw, (-webkit-min-device-pixel-ratio: 2) and (max-width: 700px) 100vw, 700px" type="image/webp"/><source data-testid="og" srcSet="https://miro.medium.com/v2/resize:fit:640/1*lGqNBMvtaXAXWP1K2jQO8A.png 640w, https://miro.medium.com/v2/resize:fit:720/1*lGqNBMvtaXAXWP1K2jQO8A.png 720w, https://miro.medium.com/v2/resize:fit:750/1*lGqNBMvtaXAXWP1K2jQO8A.png 750w, https://miro.medium.com/v2/resize:fit:786/1*lGqNBMvtaXAXWP1K2jQO8A.png 786w, https://miro.medium.com/v2/resize:fit:828/1*lGqNBMvtaXAXWP1K2jQO8A.png 828w, https://miro.medium.com/v2/resize:fit:1100/1*lGqNBMvtaXAXWP1K2jQO8A.png 1100w, https://miro.medium.com/v2/resize:fit:1400/1*lGqNBMvtaXAXWP1K2jQO8A.png 1400w" sizes="(min-resolution: 4dppx) and (max-width: 700px) 50vw, (-webkit-min-device-pixel-ratio: 4) and (max-width: 700px) 50vw, (min-resolution: 3dppx) and (max-width: 700px) 67vw, (-webkit-min-device-pixel-ratio: 3) and (max-width: 700px) 65vw, (min-resolution: 2.5dppx) and (max-width: 700px) 80vw, (-webkit-min-device-pixel-ratio: 2.5) and (max-width: 700px) 80vw, (min-resolution: 2dppx) and (max-width: 700px) 100vw, (-webkit-min-device-pixel-ratio: 2) and (max-width: 700px) 100vw, 700px"/><img alt="" class="bh hb hc c" width="700" height="255" loading="lazy" role="presentation"/></picture></div></div><figcaption class="pr ff ps gs gt pt pu bf b bg z du">Figure 2: New Data Source Placement on Technique (T1055.001) Page</figcaption></figure><p id="1a87" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">These data sources are available for all platforms of Enterprise ATT&CK, including our newest additions that cover OSINT-related data sources mapped to PRE platform techniques.</p><figure class="pi pj pk pl pm ha gs gt paragraph-image"><div role="button" tabindex="0" class="pn po fj pp bh pq"><div class="gs gt pw"><picture><source srcSet="https://miro.medium.com/v2/resize:fit:640/format:webp/1*TzINk4g4jaMGCxtIJ9rpsg.png 640w, https://miro.medium.com/v2/resize:fit:720/format:webp/1*TzINk4g4jaMGCxtIJ9rpsg.png 720w, https://miro.medium.com/v2/resize:fit:750/format:webp/1*TzINk4g4jaMGCxtIJ9rpsg.png 750w, https://miro.medium.com/v2/resize:fit:786/format:webp/1*TzINk4g4jaMGCxtIJ9rpsg.png 786w, https://miro.medium.com/v2/resize:fit:828/format:webp/1*TzINk4g4jaMGCxtIJ9rpsg.png 828w, https://miro.medium.com/v2/resize:fit:1100/format:webp/1*TzINk4g4jaMGCxtIJ9rpsg.png 1100w, https://miro.medium.com/v2/resize:fit:1400/format:webp/1*TzINk4g4jaMGCxtIJ9rpsg.png 1400w" sizes="(min-resolution: 4dppx) and (max-width: 700px) 50vw, (-webkit-min-device-pixel-ratio: 4) and (max-width: 700px) 50vw, (min-resolution: 3dppx) and (max-width: 700px) 67vw, (-webkit-min-device-pixel-ratio: 3) and (max-width: 700px) 65vw, (min-resolution: 2.5dppx) and (max-width: 700px) 80vw, (-webkit-min-device-pixel-ratio: 2.5) and (max-width: 700px) 80vw, (min-resolution: 2dppx) and (max-width: 700px) 100vw, (-webkit-min-device-pixel-ratio: 2) and (max-width: 700px) 100vw, 700px" type="image/webp"/><source data-testid="og" srcSet="https://miro.medium.com/v2/resize:fit:640/1*TzINk4g4jaMGCxtIJ9rpsg.png 640w, https://miro.medium.com/v2/resize:fit:720/1*TzINk4g4jaMGCxtIJ9rpsg.png 720w, https://miro.medium.com/v2/resize:fit:750/1*TzINk4g4jaMGCxtIJ9rpsg.png 750w, https://miro.medium.com/v2/resize:fit:786/1*TzINk4g4jaMGCxtIJ9rpsg.png 786w, https://miro.medium.com/v2/resize:fit:828/1*TzINk4g4jaMGCxtIJ9rpsg.png 828w, https://miro.medium.com/v2/resize:fit:1100/1*TzINk4g4jaMGCxtIJ9rpsg.png 1100w, https://miro.medium.com/v2/resize:fit:1400/1*TzINk4g4jaMGCxtIJ9rpsg.png 1400w" sizes="(min-resolution: 4dppx) and (max-width: 700px) 50vw, (-webkit-min-device-pixel-ratio: 4) and (max-width: 700px) 50vw, (min-resolution: 3dppx) and (max-width: 700px) 67vw, (-webkit-min-device-pixel-ratio: 3) and (max-width: 700px) 65vw, (min-resolution: 2.5dppx) and (max-width: 700px) 80vw, (-webkit-min-device-pixel-ratio: 2.5) and (max-width: 700px) 80vw, (min-resolution: 2dppx) and (max-width: 700px) 100vw, (-webkit-min-device-pixel-ratio: 2) and (max-width: 700px) 100vw, 700px"/><img alt="" class="bh hb hc c" width="700" height="381" loading="lazy" role="presentation"/></picture></div></div><figcaption class="pr ff ps gs gt pt pu bf b bg z du">Figure 4: Malware Repository Data Source Page</figcaption></figure><p id="3fff" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">These updated structures are also visible in <a class="af od" href="https://github.com/mitre/cti" rel="noopener ugc nofollow" target="_blank">ATT&CK’s STIX representation</a>, with both the data sources and the data components captured as custom STIX objects. You’ll be able to see the relationships between those objects, with the data sources featuring one or more data components, each of which detects one or more techniques. For more information about ATT&CK’s STIX representation, including these new objects and relationships, you can check out our <a class="af od" href="https://github.com/mitre/cti/blob/master/USAGE.md" rel="noopener ugc nofollow" target="_blank">STIX usage document</a>.</p><figure class="pi pj pk pl pm ha gs gt paragraph-image"><div class="gs gt gu"><picture><source srcSet="https://miro.medium.com/v2/resize:fit:640/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 640w, https://miro.medium.com/v2/resize:fit:720/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 720w, https://miro.medium.com/v2/resize:fit:750/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 750w, https://miro.medium.com/v2/resize:fit:786/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 786w, https://miro.medium.com/v2/resize:fit:828/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 828w, https://miro.medium.com/v2/resize:fit:1100/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 1100w, https://miro.medium.com/v2/resize:fit:1024/format:webp/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 1024w" sizes="(min-resolution: 4dppx) and (max-width: 700px) 50vw, (-webkit-min-device-pixel-ratio: 4) and (max-width: 700px) 50vw, (min-resolution: 3dppx) and (max-width: 700px) 67vw, (-webkit-min-device-pixel-ratio: 3) and (max-width: 700px) 65vw, (min-resolution: 2.5dppx) and (max-width: 700px) 80vw, (-webkit-min-device-pixel-ratio: 2.5) and (max-width: 700px) 80vw, (min-resolution: 2dppx) and (max-width: 700px) 100vw, (-webkit-min-device-pixel-ratio: 2) and (max-width: 700px) 100vw, 512px" type="image/webp"/><source data-testid="og" srcSet="https://miro.medium.com/v2/resize:fit:640/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 640w, https://miro.medium.com/v2/resize:fit:720/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 720w, https://miro.medium.com/v2/resize:fit:750/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 750w, https://miro.medium.com/v2/resize:fit:786/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 786w, https://miro.medium.com/v2/resize:fit:828/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 828w, https://miro.medium.com/v2/resize:fit:1100/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 1100w, https://miro.medium.com/v2/resize:fit:1024/1*aghj7RR33HlT_i1FVYx_eQ.jpeg 1024w" sizes="(min-resolution: 4dppx) and (max-width: 700px) 50vw, (-webkit-min-device-pixel-ratio: 4) and (max-width: 700px) 50vw, (min-resolution: 3dppx) and (max-width: 700px) 67vw, (-webkit-min-device-pixel-ratio: 3) and (max-width: 700px) 65vw, (min-resolution: 2.5dppx) and (max-width: 700px) 80vw, (-webkit-min-device-pixel-ratio: 2.5) and (max-width: 700px) 80vw, (min-resolution: 2dppx) and (max-width: 700px) 100vw, (-webkit-min-device-pixel-ratio: 2) and (max-width: 700px) 100vw, 512px"/><img alt="" class="bh hb hc c" width="512" height="312" loading="lazy" role="presentation"/></picture></div><figcaption class="pr ff ps gs gt pt pu bf b bg z du">Figure 5: Data Source STIX Model</figcaption></figure><p id="e176" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">We hope that these enhancements further increase our ability to translate our understanding of the adversary behaviors captured within ATT&CK to the data we collect as defenders. We are very excited to see these data source objects grow and evolve, and like the rest of ATT&CK, invite the community to submit contributions and feedback!</p><p id="f9f6" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk"><strong class="ng hg">Note:</strong> We will no longer be working with Enterprise data sources in GitHub after ATT&CK v10. Moving forward we will accept all related contributions through our <a class="af od" href="https://attack.mitre.org/resources/contribute/" rel="noopener ugc nofollow" target="_blank">normal contribution process</a>.</p><h1 id="b8ec" class="oe of hf bf og oh oi oj ok ol om on oo op oq or os ot ou ov ow ox oy oz pa pb bk">MacOS and Linux: Now with New Content!</h1><p id="78cc" class="pw-post-body-paragraph ne nf hf ng b nh pc nj nk nl pd nn no np pe nr ns nt pf nv nw nx pg nz oa ob gn bk">Over the past several months, we’ve been continuing to improve and expand coverage across the <a class="af od" href="https://attack.mitre.org/matrices/enterprise/macos/" rel="noopener ugc nofollow" target="_blank">macOS</a> and <a class="af od" href="https://attack.mitre.org/matrices/enterprise/linux/" rel="noopener ugc nofollow" target="_blank">Linux</a> platforms. We understand adversaries actively target these platforms, however there is significantly less public reporting for adversarial hands-on-keyboard procedures and malware analysis. We’re pleased to report that we’ve been collaborating with macOS security and vulnerability research contributors across the globe to address these challenges. In upcoming releases, we’re hoping to leverage this same community engagement for Linux. We’re excited to see the growth in content from the community’s contribution, and the improvements ranging from how we capture new techniques to conveying the impact of existing techniques was a collaborative effort.</p><p id="7d75" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">One of the most notable changes we made for techniques across the board was providing more in-depth references and use-cases on how procedures and processes work, and the impact they have. Remote services along with additional techniques for macOS and Linux received some attention, but most improvements were more detailed examples in the description section with supporting detection ideas. Along with the rest of Enterprise, we also updated our macOS data sources to enhance defender visibility.</p><h1 id="776b" class="oe of hf bf og oh oi oj ok ol om on oo op oq or os ot ou ov ow ox oy oz pa pb bk"><strong class="al">ICS</strong> <strong class="al">: Object-Oriented and Integrating</strong></h1><p id="f32d" class="pw-post-body-paragraph ne nf hf ng b nh pc nj nk nl pd nn no np pe nr ns nt pf nv nw nx pg nz oa ob gn bk">ICS has been focusing on feature equity with Enterprise, including updating data sources, adding and refining techniques, revamping assets, and charting out our detections plan. We’re also making some key changes to facilitate hunting in ICS environments. As we noted in the <a class="af od" rel="noopener" href="/mitre-attack/att-ck-2021-roadmap-68bab3886fa2">2021 Roadmap</a>, v10 also includes cross-domain mappings of Enterprise techniques to software that were previously only represented in the ICS Matrix, including Stuxnet, Industroyer, and several others. <a class="af od" rel="noopener" href="/mitre-attack/in-pursuit-of-a-gestalt-visualization-merging-mitre-att-ck-for-enterprise-and-ics-to-communicate-3523daa7b580">The fact that adversaries don’t respect theoretical boundaries is something we’ve consistently emphasized</a>, and we think it’s crucial to feature Enterprise-centric mappings for more comprehensive coverage of all the behaviors exhibited by the software. With Stuxnet and Industroyer specifically, both malware operated within OT/ICS networks, but the two incidents displayed techniques that are also well researched and represented within the Enterprise matrix. Based on this, we created Enterprise entries for the ICS-focused software to provide network defenders with a view of software behavior spanning both matrices. We also expect the cross-domain mappings to enable you to leverage the knowledge bases together more effectively.</p><p id="822f" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">For data sources, we’re aligning with Enterprise ATT&CK in updating data source names. ICS’s current release reflects Enterprise’s v9 data sources update, with the new name format and content featured in GitHub. These data sources will be linked to YAML files that provide more detail, including what the data sources are and how they should be used. For future releases we plan on mapping the more granular <a class="af od" href="https://collaborate.mitre.org/attackics/index.php/All_Assets" rel="noopener ugc nofollow" target="_blank">assets</a> to techniques to enable you to track how these behaviors can affect a technique, or what assets these behaviors are associated with. On the detections front, we’re working behind the scenes to add detections to each technique, and this will be reflected in future releases (we expect detections to really help out in hunt and continuous monitoring). Also in 2022, we’re preparing to integrate onto the same development platform as Enterprise, the <a class="af od" href="https://ctid.mitre-engenuity.org/our-work/attack-workbench/" rel="noopener ugc nofollow" target="_blank">ATT&CK Workbench</a>, and join the rest of the domains on the ATT&CK website (attack.mitre.org).</p><h1 id="c8cf" class="oe of hf bf og oh oi oj ok ol om on oo op oq or os ot ou ov ow ox oy oz pa pb bk">Expanding Our Mobile Features</h1><p id="4f76" class="pw-post-body-paragraph ne nf hf ng b nh pc nj nk nl pd nn no np pe nr ns nt pf nv nw nx pg nz oa ob gn bk">In the Mobile space, we’ve been focused on catching up on the contributions from the community, updating (sub-)techniques, Groups, and Software, and enhancing general parity with Enterprise. We’ve also been working hard behind the scenes to implement sub-techniques as mentioned in our <a class="af od" rel="noopener" href="/mitre-attack/att-ck-2021-roadmap-68bab3886fa2">2021 Roadmap</a>. We’re excited to introduce this new Mobile structure in April 2022, to better align with other platforms on Enterprise. Our plan is to do a beta release for the sub-techniques prior to the release of v11 to provide you with an opportunity to test out those updates and provide feedback.</p><h1 id="519d" class="oe of hf bf og oh oi oj ok ol om on oo op oq or os ot ou ov ow ox oy oz pa pb bk">About Cloud</h1><p id="c219" class="pw-post-body-paragraph ne nf hf ng b nh pc nj nk nl pd nn no np pe nr ns nt pf nv nw nx pg nz oa ob gn bk">Along with the rest of Enterprise, we’ve been updating content across Cloud, collaborating with community members on activity in the Cloud domain, and keeping an eye out for new platforms to add to the space. We also continued working on data sources, although as we outlined for the v9 release, our Cloud data sources are a little different than the host-based data sources, specifically aligning more with the events and APIs involved in detections instead of just focusing on the log sources.</p><h1 id="17e5" class="oe of hf bf og oh oi oj ok ol om on oo op oq or os ot ou ov ow ox oy oz pa pb bk">What’s Next in 2022?</h1><p id="9990" class="pw-post-body-paragraph ne nf hf ng b nh pc nj nk nl pd nn no np pe nr ns nt pf nv nw nx pg nz oa ob gn bk">We hope you’re as excited as we are about v10, and we’d love your feedback and for you to join us in shaping our v11 release. We already have a lot on the horizon for 2022, included structured detections, campaigns, tools to enable overlays and combinations, and ATT&CKcon. If you have feedback, comments, contributions, or just want to ask questions, connect with us on <a class="af od" href="mailto:attack@mitre.org" rel="noopener ugc nofollow" target="_blank">email</a>, <a class="af od" href="https://twitter.com/MITREattack?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor" rel="noopener ugc nofollow" target="_blank">Twitter</a>, or <a class="af od" href="https://join.slack.com/t/mitreattack/shared_invite/zt-ny1a3yon-XkT_OS1IF~ZYrESq8Xtqjg" rel="noopener ugc nofollow" target="_blank">Slack</a>.</p><p id="e63e" class="pw-post-body-paragraph ne nf hf ng b nh ni nj nk nl nm nn no np nq nr ns nt nu nv nw nx ny nz oa ob gn bk">©2021 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21–00706–18.</p></div></div></div></div></section></div></div></article></div><div class="ab cb"><div class="ci bh fz ga gb gc"><div class="px py ab jl"><div class="pz ab"><a class="qa ay am ao" rel="noopener follow" href="/tag/attck-v10?source=post_page-----7743870b37e3---------------------------------------"><div class="qb fj cx qc ge qd qe bf b bg z bk qf">Attck V10</div></a></div><div class="pz ab"><a class="qa ay am ao" rel="noopener follow" href="/tag/attck-release?source=post_page-----7743870b37e3---------------------------------------"><div class="qb fj cx qc ge qd qe bf b bg z bk qf">Attck Release</div></a></div><div class="pz ab"><a class="qa ay am ao" rel="noopener follow" href="/tag/data-sources?source=post_page-----7743870b37e3---------------------------------------"><div class="qb fj cx qc ge qd qe bf b bg z bk qf">Data Sources</div></a></div><div class="pz ab"><a class="qa ay am ao" rel="noopener follow" href="/tag/release-notes?source=post_page-----7743870b37e3---------------------------------------"><div class="qb fj cx qc ge qd qe bf b bg z bk qf">Release Notes</div></a></div></div></div></div><div class="l"></div><footer class="qg qh qi qj qk ab q ql iv c"><div class="l ae"><div class="ab cb"><div class="ci bh fz ga gb gc"><div class="ab cp qm"><div class="ab q le"><div class="qn l"><span class="l qo qp qq e d"><div class="ab q le lf"><div class="pw-multi-vote-icon fj jn lg lh li"><span><a class="af ag ah ai aj ak al am an ao ap aq ar as at" data-testid="footerClapButton" rel="noopener follow" href="/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fmitre-attack%2F7743870b37e3&operation=register&redirect=https%3A%2F%2Fmedium.com%2Fmitre-attack%2Fintroducing-attack-v10-7743870b37e3&user=Amy+L.+Robertson&userId=13b16fa8065d&source=---footer_actions--7743870b37e3---------------------clap_footer------------------"><div><div class="bm" aria-hidden="false"><div class="lj ao lk ll lm ln am lo lp lq li"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-label="clap"><path fill-rule="evenodd" d="M11.37.828 12 3.282l.63-2.454zM13.916 3.953l1.523-2.112-1.184-.39zM8.589 1.84l1.522 2.112-.337-2.501zM18.523 18.92c-.86.86-1.75 1.246-2.62 1.33a6 6 0 0 0 .407-.372c2.388-2.389 2.86-4.951 1.399-7.623l-.912-1.603-.79-1.672c-.26-.56-.194-.98.203-1.288a.7.7 0 0 1 .546-.132c.283.046.546.231.728.5l2.363 4.157c.976 1.624 1.141 4.237-1.324 6.702m-10.999-.438L3.37 14.328a.828.828 0 0 1 .585-1.408.83.83 0 0 1 .585.242l2.158 2.157a.365.365 0 0 0 .516-.516l-2.157-2.158-1.449-1.449a.826.826 0 0 1 1.167-1.17l3.438 3.44a.363.363 0 0 0 .516 0 .364.364 0 0 0 0-.516L5.293 9.513l-.97-.97a.826.826 0 0 1 0-1.166.84.84 0 0 1 1.167 0l.97.968 3.437 3.436a.36.36 0 0 0 .517 0 .366.366 0 0 0 0-.516L6.977 7.83a.82.82 0 0 1-.241-.584.82.82 0 0 1 .824-.826c.219 0 .43.087.584.242l5.787 5.787a.366.366 0 0 0 .587-.415l-1.117-2.363c-.26-.56-.194-.98.204-1.289a.7.7 0 0 1 .546-.132c.283.046.545.232.727.501l2.193 3.86c1.302 2.38.883 4.59-1.277 6.75-1.156 1.156-2.602 1.627-4.19 1.367-1.418-.236-2.866-1.033-4.079-2.246M10.75 5.971l2.12 2.12c-.41.502-.465 1.17-.128 1.89l.22.465-3.523-3.523a.8.8 0 0 1-.097-.368c0-.22.086-.428.241-.584a.847.847 0 0 1 1.167 0m7.355 1.705c-.31-.461-.746-.758-1.23-.837a1.44 1.44 0 0 0-1.11.275c-.312.24-.505.543-.59.881a1.74 1.74 0 0 0-.906-.465 1.47 1.47 0 0 0-.82.106l-2.182-2.182a1.56 1.56 0 0 0-2.2 0 1.54 1.54 0 0 0-.396.701 1.56 1.56 0 0 0-2.21-.01 1.55 1.55 0 0 0-.416.753c-.624-.624-1.649-.624-2.237-.037a1.557 1.557 0 0 0 0 2.2c-.239.1-.501.238-.715.453a1.56 1.56 0 0 0 0 2.2l.516.515a1.556 1.556 0 0 0-.753 2.615L7.01 19c1.32 1.319 2.909 2.189 4.475 2.449q.482.08.971.08c.85 0 1.653-.198 2.393-.579.231.033.46.054.686.054 1.266 0 2.457-.52 3.505-1.567 2.763-2.763 2.552-5.734 1.439-7.586z" clip-rule="evenodd"></path></svg></div></div></div></a></span></div><div class="pw-multi-vote-count l lr ls lt lu lv lw lx"><p class="bf b dv z du"><span class="ly">--</span></p></div></div></span><span class="l h g f qr qs"><div class="ab q le lf"><div class="pw-multi-vote-icon fj jn lg lh li"><span><a class="af ag ah ai aj ak al am an ao ap aq ar as at" data-testid="footerClapButton" rel="noopener follow" href="/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fmitre-attack%2F7743870b37e3&operation=register&redirect=https%3A%2F%2Fmedium.com%2Fmitre-attack%2Fintroducing-attack-v10-7743870b37e3&user=Amy+L.+Robertson&userId=13b16fa8065d&source=---footer_actions--7743870b37e3---------------------clap_footer------------------"><div><div class="bm" aria-hidden="false"><div class="lj ao lk ll lm ln am lo lp lq li"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" aria-label="clap"><path fill-rule="evenodd" d="M11.37.828 12 3.282l.63-2.454zM13.916 3.953l1.523-2.112-1.184-.39zM8.589 1.84l1.522 2.112-.337-2.501zM18.523 18.92c-.86.86-1.75 1.246-2.62 1.33a6 6 0 0 0 .407-.372c2.388-2.389 2.86-4.951 1.399-7.623l-.912-1.603-.79-1.672c-.26-.56-.194-.98.203-1.288a.7.7 0 0 1 .546-.132c.283.046.546.231.728.5l2.363 4.157c.976 1.624 1.141 4.237-1.324 6.702m-10.999-.438L3.37 14.328a.828.828 0 0 1 .585-1.408.83.83 0 0 1 .585.242l2.158 2.157a.365.365 0 0 0 .516-.516l-2.157-2.158-1.449-1.449a.826.826 0 0 1 1.167-1.17l3.438 3.44a.363.363 0 0 0 .516 0 .364.364 0 0 0 0-.516L5.293 9.513l-.97-.97a.826.826 0 0 1 0-1.166.84.84 0 0 1 1.167 0l.97.968 3.437 3.436a.36.36 0 0 0 .517 0 .366.366 0 0 0 0-.516L6.977 7.83a.82.82 0 0 1-.241-.584.82.82 0 0 1 .824-.826c.219 0 .43.087.584.242l5.787 5.787a.366.366 0 0 0 .587-.415l-1.117-2.363c-.26-.56-.194-.98.204-1.289a.7.7 0 0 1 .546-.132c.283.046.545.232.727.501l2.193 3.86c1.302 2.38.883 4.59-1.277 6.75-1.156 1.156-2.602 1.627-4.19 1.367-1.418-.236-2.866-1.033-4.079-2.246M10.75 5.971l2.12 2.12c-.41.502-.465 1.17-.128 1.89l.22.465-3.523-3.523a.8.8 0 0 1-.097-.368c0-.22.086-.428.241-.584a.847.847 0 0 1 1.167 0m7.355 1.705c-.31-.461-.746-.758-1.23-.837a1.44 1.44 0 0 0-1.11.275c-.312.24-.505.543-.59.881a1.74 1.74 0 0 0-.906-.465 1.47 1.47 0 0 0-.82.106l-2.182-2.182a1.56 1.56 0 0 0-2.2 0 1.54 1.54 0 0 0-.396.701 1.56 1.56 0 0 0-2.21-.01 1.55 1.55 0 0 0-.416.753c-.624-.624-1.649-.624-2.237-.037a1.557 1.557 0 0 0 0 2.2c-.239.1-.501.238-.715.453a1.56 1.56 0 0 0 0 2.2l.516.515a1.556 1.556 0 0 0-.753 2.615L7.01 19c1.32 1.319 2.909 2.189 4.475 2.449q.482.08.971.08c.85 0 1.653-.198 2.393-.579.231.033.46.054.686.054 1.266 0 2.457-.52 3.505-1.567 2.763-2.763 2.552-5.734 1.439-7.586z" clip-rule="evenodd"></path></svg></div></div></div></a></span></div><div class="pw-multi-vote-count l lr ls lt lu lv lw lx"><p class="bf b dv z du"><span class="ly">--</span></p></div></div></span></div><div class="bq ab"><div><div class="bm" aria-hidden="false"><button class="ao lj lz ma ab q fk mb mc" aria-label="responses"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" class="md"><path d="M18.006 16.803c1.533-1.456 2.234-3.325 2.234-5.321C20.24 7.357 16.709 4 12.191 4S4 7.357 4 11.482c0 4.126 3.674 7.482 8.191 7.482.817 0 1.622-.111 2.393-.327.231.2.48.391.744.559 1.06.693 2.203 1.044 3.399 1.044.224-.008.4-.112.486-.287a.49.49 0 0 0-.042-.518c-.495-.67-.845-1.364-1.04-2.057a4 4 0 0 1-.125-.598zm-3.122 1.055-.067-.223-.315.096a8 8 0 0 1-2.311.338c-4.023 0-7.292-2.955-7.292-6.587 0-3.633 3.269-6.588 7.292-6.588 4.014 0 7.112 2.958 7.112 6.593 0 1.794-.608 3.469-2.027 4.72l-.195.168v.255c0 .056 0 .151.016.295.025.231.081.478.154.733.154.558.398 1.117.722 1.659a5.3 5.3 0 0 1-2.165-.845c-.276-.176-.714-.383-.941-.59z"></path></svg></button></div></div></div></div><div class="ab q"><div class="qt l ji"><div><div class="bm" aria-hidden="false"><span><a class="af ag ah ai aj ak al am an ao ap aq ar as at" data-testid="footerBookmarkButton" rel="noopener follow" href="/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F7743870b37e3&operation=register&redirect=https%3A%2F%2Fmedium.com%2Fmitre-attack%2Fintroducing-attack-v10-7743870b37e3&source=---footer_actions--7743870b37e3---------------------bookmark_footer------------------"><svg xmlns="http://www.w3.org/2000/svg" width="25" height="25" fill="none" viewBox="0 0 25 25" class="du mf" aria-label="Add to list bookmark button"><path fill="currentColor" d="M18 2.5a.5.5 0 0 1 1 0V5h2.5a.5.5 0 0 1 0 1H19v2.5a.5.5 0 1 1-1 0V6h-2.5a.5.5 0 0 1 0-1H18zM7 7a1 1 0 0 1 1-1h3.5a.5.5 0 0 0 0-1H8a2 2 0 0 0-2 2v14a.5.5 0 0 0 .805.396L12.5 17l5.695 4.396A.5.5 0 0 0 19 21v-8.5a.5.5 0 0 0-1 0v7.485l-5.195-4.012a.5.5 0 0 0-.61 0L7 19.985z"></path></svg></a></span></div></div></div><div class="qt l ji"><div class="bm" aria-hidden="false" aria-describedby="postFooterSocialMenu" aria-labelledby="postFooterSocialMenu"><div><div class="bm" aria-hidden="false"><button aria-controls="postFooterSocialMenu" aria-expanded="false" aria-label="Share Post" data-testid="footerSocialShareButton" class="af fk ah ai aj ak al mm an ao ap ex mn mo mc mp"><svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" viewBox="0 0 24 24"><path fill="currentColor" fill-rule="evenodd" d="M15.218 4.931a.4.4 0 0 1-.118.132l.012.006a.45.45 0 0 1-.292.074.5.5 0 0 1-.3-.13l-2.02-2.02v7.07c0 .28-.23.5-.5.5s-.5-.22-.5-.5v-7.04l-2 2a.45.45 0 0 1-.57.04h-.02a.4.4 0 0 1-.16-.3.4.4 0 0 1 .1-.32l2.8-2.8a.5.5 0 0 1 .7 0l2.8 2.79a.42.42 0 0 1 .068.498m-.106.138.008.004v-.01zM16 7.063h1.5a2 2 0 0 1 2 2v10a2 2 0 0 1-2 2h-11c-1.1 0-2-.9-2-2v-10a2 2 0 0 1 2-2H8a.5.5 0 0 1 .35.15.5.5 0 0 1 .15.35.5.5 0 0 1-.15.35.5.5 0 0 1-.35.15H6.4c-.5 0-.9.4-.9.9v10.2a.9.9 0 0 0 .9.9h11.2c.5 0 .9-.4.9-.9v-10.2c0-.5-.4-.9-.9-.9H16a.5.5 0 0 1 0-1" clip-rule="evenodd"></path></svg></button></div></div></div></div></div></div></div></div></div></footer><div class="qu l"><div><div class="ab cb"><div class="ci bh fz ga gb gc"><div class="qv l"><div class="ab qw qx qy jk jj"><div class="qz ra rb rc rd re rf rg rh ri ab cp"><div class="h k"><a href="https://medium.com/mitre-attack?source=post_page---post_publication_info--7743870b37e3---------------------------------------" rel="noopener follow"><div class="fj ab"><img alt="MITRE ATT&CK®" class="rj im in cx" src="https://miro.medium.com/v2/resize:fill:96:96/1*Y6LKGEIzmF96lVHkv_RS9A.png" width="48" height="48" loading="lazy"/><div class="rj l in im fs n fr rk"></div></div></a></div><div class="j i d"><a href="https://medium.com/mitre-attack?source=post_page---post_publication_info--7743870b37e3---------------------------------------" rel="noopener follow"><div class="fj ab"><img alt="MITRE ATT&CK®" class="rj rm rl cx" src="https://miro.medium.com/v2/resize:fill:128:128/1*Y6LKGEIzmF96lVHkv_RS9A.png" width="64" height="64" loading="lazy"/><div class="rj l rl rm fs n fr rk"></div></div></a></div><div class="j i d rn ji"><div class="ab"></div></div></div><div class="ab co ro"><div class="rp rq rr rs rt l"><a class="af ag ah aj ak al am an ao ap aq ar as at ab q" href="https://medium.com/mitre-attack?source=post_page---post_publication_info--7743870b37e3---------------------------------------" rel="noopener follow"><h2 class="pw-author-name bf rv rw rx ry rz sa sb np sc sd nt se sf nx sg sh bk"><span class="gn ru">Published in MITRE ATT&CK®</span></h2></a><div class="pz ab il"><div class="l ji"><span class="pw-follower-count bf b bg z du"><a class="af ag ah ai aj ak al am an ao ap aq ar jb" rel="noopener follow" href="/mitre-attack/followers?source=post_page---post_publication_info--7743870b37e3---------------------------------------">6.6K Followers</a></span></div><div class="bf b bg z du ab jm"><span class="jc l" aria-hidden="true"><span class="bf b bg z du">·</span></span><a class="af ag ah ai aj ak al am an ao ap aq ar jb" rel="noopener follow" href="/mitre-attack/attack-v16-561c76af94cf?source=post_page---post_publication_info--7743870b37e3---------------------------------------">Last published <span>Oct 31, 2024</span></a></div></div><div class="si l"><p class="bf b bg z bk">This is the official blog for MITRE ATT&CK®, the MITRE-developed, globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The full website is located at <a class="af ag ah ai aj ak al am an ao ap aq ar od go" href="https://attack.mitre.org" rel="noopener ugc nofollow">https://attack.mitre.org</a>.</p></div></div></div><div class="h k"><div class="ab"></div></div></div></div><div class="ab qw qx qy jk jj"><div class="qz ra rb rc rd re rf rg rh ri ab cp"><div class="h k"><a tabindex="0" rel="noopener follow" href="/@arobertson_79988?source=post_page---post_author_info--7743870b37e3---------------------------------------"><div class="l fj"><img alt="Amy L. Robertson" class="l fd by in im cx" src="https://miro.medium.com/v2/resize:fill:96:96/1*HSqNMSnjesj-UnJGDPJi7g.jpeg" width="48" height="48" loading="lazy"/><div class="fr by l in im fs n ay rk"></div></div></a></div><div class="j i d"><a tabindex="0" rel="noopener follow" href="/@arobertson_79988?source=post_page---post_author_info--7743870b37e3---------------------------------------"><div class="l fj"><img alt="Amy L. Robertson" class="l fd by rl rm cx" src="https://miro.medium.com/v2/resize:fill:128:128/1*HSqNMSnjesj-UnJGDPJi7g.jpeg" width="64" height="64" loading="lazy"/><div class="fr by l rl rm fs n ay rk"></div></div></a></div><div class="j i d rn ji"><div class="ab"><span><button class="bf b bg z sj qb sk sl sm sn so ev ew sp sq sr fa fb fc fd bm fe ff">Follow</button></span></div></div></div><div class="ab co ro"><div class="rp rq rr rs rt l"><a class="af ag ah aj ak al am an ao ap aq ar as at ab q" rel="noopener follow" href="/@arobertson_79988?source=post_page---post_author_info--7743870b37e3---------------------------------------"><h2 class="pw-author-name bf rv rw rx ry rz sa sb np sc sd nt se sf nx sg sh bk"><span class="gn ru">Written by Amy L. Robertson</span></h2></a><div class="pz ab il"><div class="l ji"><span class="pw-follower-count bf b bg z du"><a class="af ag ah ai aj ak al am an ao ap aq ar jb" rel="noopener follow" href="/@arobertson_79988/followers?source=post_page---post_author_info--7743870b37e3---------------------------------------">633 Followers</a></span></div><div class="bf b bg z du ab jm"><span class="jc l" aria-hidden="true"><span class="bf b bg z du">·</span></span><a class="af ag ah ai aj ak al am an ao ap aq ar jb" rel="noopener follow" href="/@arobertson_79988/following?source=post_page---post_author_info--7743870b37e3---------------------------------------">5 Following</a></div></div><div class="si l"></div></div></div><div class="h k"><div class="ab"><span><button class="bf b bg z sj qb sk sl sm sn so ev ew sp sq sr fa fb fc fd bm fe ff">Follow</button></span></div></div></div></div></div></div></div><div class="ss l"><div class="st bh r qu"></div><div class="ab cb"><div class="ci bh fz ga gb gc"><div class="ab q cp"><h2 class="bf rv oh oj ok ol on oo op or os ot ov ow ox oz pa bk">No responses yet</h2><div class="ab su"><div><div class="bm" aria-hidden="false"><a class="sv sw" href="https://policy.medium.com/medium-rules-30e5502c4eb4?source=post_page---post_responses--7743870b37e3---------------------------------------" rel="noopener follow" target="_blank"><svg xmlns="http://www.w3.org/2000/svg" width="25" height="25" viewBox="0 0 25 25"><path fill-rule="evenodd" d="M11.987 5.036a.754.754 0 0 1 .914-.01c.972.721 1.767 1.218 2.6 1.543.828.322 1.719.485 2.887.505a.755.755 0 0 1 .741.757c-.018 3.623-.43 6.256-1.449 8.21-1.034 1.984-2.662 3.209-4.966 4.083a.75.75 0 0 1-.537-.003c-2.243-.874-3.858-2.095-4.897-4.074-1.024-1.951-1.457-4.583-1.476-8.216a.755.755 0 0 1 .741-.757c1.195-.02 2.1-.182 2.923-.503.827-.322 1.6-.815 2.519-1.535m.468.903c-.897.69-1.717 1.21-2.623 1.564-.898.35-1.856.527-3.026.565.037 3.45.469 5.817 1.36 7.515.884 1.684 2.25 2.762 4.284 3.571 2.092-.81 3.465-1.89 4.344-3.575.886-1.698 1.299-4.065 1.334-7.512-1.149-.039-2.091-.217-2.99-.567-.906-.353-1.745-.873-2.683-1.561m-.009 9.155a2.672 2.672 0 1 0 0-5.344 2.672 2.672 0 0 0 0 5.344m0 1a3.672 3.672 0 1 0 0-7.344 3.672 3.672 0 0 0 0 7.344m-1.813-3.777.525-.526.916.917 1.623-1.625.526.526-2.149 2.152z" clip-rule="evenodd"></path></svg></a></div></div></div></div><div class="sx sy sz ta tb l"></div></div></div></div><div class="tc td te tf tg l bx"><div class="h k j"><div class="st bh th ti"></div><div class="ab cb"><div class="ci bh fz ga gb gc"><div class="tj ab le jl"><div class="tk tl l"><a class="af ag ah ai aj ak al am an ao ap aq ar as at" href="https://help.medium.com/hc/en-us?source=post_page-----7743870b37e3---------------------------------------" rel="noopener follow"><p class="bf b dv z du">Help</p></a></div><div class="tk tl l"><a class="af ag ah ai aj ak al am an ao ap aq ar as at" href="https://medium.statuspage.io/?source=post_page-----7743870b37e3---------------------------------------" rel="noopener follow"><p class="bf b dv z du">Status</p></a></div><div class="tk tl l"><a class="af ag ah ai aj ak al am an ao ap aq ar as at" rel="noopener follow" href="/about?autoplay=1&source=post_page-----7743870b37e3---------------------------------------"><p class="bf b dv z du">About</p></a></div><div class="tk tl l"><a class="af ag ah ai aj ak al am an ao ap aq ar as at" rel="noopener follow" href="/jobs-at-medium/work-at-medium-959d1a85284e?source=post_page-----7743870b37e3---------------------------------------"><p class="bf b dv z du">Careers</p></a></div><div class="tk tl l"><a class="af ag ah ai aj ak al am an ao ap aq ar as at" href="mailto:pressinquiries@medium.com" rel="noopener follow"><p class="bf b dv z du">Press</p></a></div><div class="tk tl l"><a class="af ag ah ai aj ak al am an ao ap aq ar as at" href="https://blog.medium.com/?source=post_page-----7743870b37e3---------------------------------------" rel="noopener follow"><p class="bf b dv z du">Blog</p></a></div><div class="tk tl l"><a class="af ag ah ai aj ak al am an ao ap aq ar as at" href="https://policy.medium.com/medium-privacy-policy-f03bf92035c9?source=post_page-----7743870b37e3---------------------------------------" rel="noopener follow"><p class="bf b dv z du">Privacy</p></a></div><div class="tk tl l"><a class="af ag ah ai aj ak al am an ao ap aq ar as at" href="https://policy.medium.com/medium-terms-of-service-9db0094a1e0f?source=post_page-----7743870b37e3---------------------------------------" rel="noopener follow"><p class="bf b dv z du">Terms</p></a></div><div class="tk tl l"><a class="af ag ah ai aj ak al am an ao ap aq ar as at" href="https://speechify.com/medium?source=post_page-----7743870b37e3---------------------------------------" rel="noopener follow"><p class="bf b dv z du">Text to speech</p></a></div><div class="tk l"><a class="af ag ah ai aj ak al am an ao ap aq ar as at" rel="noopener follow" href="/business?source=post_page-----7743870b37e3---------------------------------------"><p class="bf b dv z du">Teams</p></a></div></div></div></div></div></div></div></div></div></div><script>window.__BUILD_ID__="main-20250217-152844-ca206ec2ba"</script><script>window.__GRAPHQL_URI__ = "https://medium.com/_/graphql"</script><script>window.__PRELOADED_STATE__ = {"algolia":{"queries":{}},"cache":{"experimentGroupSet":true,"reason":"","group":"enabled","tags":["group-edgeCachePosts","post-7743870b37e3","user-13b16fa8065d","collection-6da19bd08fba"],"serverVariantState":"44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","middlewareEnabled":true,"cacheStatus":"DYNAMIC","shouldUseCache":true,"vary":[],"pubFeaturingPostPageLabelEnabled":false},"client":{"hydrated":false,"isUs":false,"isNativeMedium":false,"isSafariMobile":false,"isSafari":false,"isFirefox":false,"routingEntity":{"type":"DEFAULT","explicit":false},"viewerIsBot":false},"debug":{"requestId":"7a611bc7-d66d-47c4-8076-13b23945a276","requestTag":"","hybridDevServices":[],"originalSpanCarrier":{"traceparent":"00-e97f6da30572c34850d70aa755284f69-c79ada147af1d421-01"}},"multiVote":{"clapsPerPost":{}},"navigation":{"branch":{"show":null,"hasRendered":null,"blockedByCTA":false},"hideGoogleOneTap":false,"hasRenderedAlternateUserBanner":null,"currentLocation":"https:\u002F\u002Fmedium.com\u002Fmitre-attack\u002Fintroducing-attack-v10-7743870b37e3","host":"medium.com","hostname":"medium.com","referrer":"","hasSetReferrer":false,"susiModal":{"step":null,"operation":"register"},"postRead":false,"partnerProgram":{"selectedCountryCode":null},"queryString":"","currentHash":""},"config":{"nodeEnv":"production","version":"main-20250217-152844-ca206ec2ba","target":"production","productName":"Medium","publicUrl":"https:\u002F\u002Fcdn-client.medium.com\u002Flite","authDomain":"medium.com","authGoogleClientId":"216296035834-k1k6qe060s2tp2a2jam4ljdcms00sttg.apps.googleusercontent.com","favicon":"production","glyphUrl":"https:\u002F\u002Fglyph.medium.com","branchKey":"key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm","algolia":{"appId":"MQ57UUUQZ2","apiKeySearch":"394474ced050e3911ae2249ecc774921","indexPrefix":"medium_","host":"-dsn.algolia.net"},"recaptchaKey":"6Lfc37IUAAAAAKGGtC6rLS13R1Hrw_BqADfS1LRk","recaptcha3Key":"6Lf8R9wUAAAAABMI_85Wb8melS7Zj6ziuf99Yot5","recaptchaEnterpriseKeyId":"6Le-uGgpAAAAAPprRaokM8AKthQ9KNGdoxaGUvVp","datadog":{"applicationId":"6702d87d-a7e0-42fe-bbcb-95b469547ea0","clientToken":"pub853ea8d17ad6821d9f8f11861d23dfed","rumToken":"pubf9cc52896502b9413b68ba36fc0c7162","context":{"deployment":{"target":"production","tag":"main-20250217-152844-ca206ec2ba","commit":"ca206ec2ba708507b1bef4ec007a67163085196c"}},"datacenter":"us"},"googleAnalyticsCode":"G-7JY7T788PK","googlePay":{"apiVersion":"2","apiVersionMinor":"0","merchantId":"BCR2DN6TV7EMTGBM","merchantName":"Medium","instanceMerchantId":"13685562959212738550"},"applePay":{"version":3},"signInWallCustomDomainCollectionIds":["3a8144eabfe3","336d898217ee","61061eb0c96b","138adf9c44c","819cc2aaeee0"],"mediumMastodonDomainName":"me.dm","mediumOwnedAndOperatedCollectionIds":["8a9336e5bb4","b7e45b22fec3","193b68bd4fba","8d6b8a439e32","54c98c43354d","3f6ecf56618","d944778ce714","92d2092dc598","ae2a65f35510","1285ba81cada","544c7006046e","fc8964313712","40187e704f1c","88d9857e584e","7b6769f2748b","bcc38c8f6edf","cef6983b292","cb8577c9149e","444d13b52878","713d7dbc99b0","ef8e90590e66","191186aaafa0","55760f21cdc5","9dc80918cc93","bdc4052bbdba","8ccfed20cbb2"],"tierOneDomains":["medium.com","thebolditalic.com","arcdigital.media","towardsdatascience.com","uxdesign.cc","codeburst.io","psiloveyou.xyz","writingcooperative.com","entrepreneurshandbook.co","prototypr.io","betterhumans.coach.me","theascent.pub"],"topicsToFollow":["d61cf867d93f","8a146bc21b28","1eca0103fff3","4d562ee63426","aef1078a3ef5","e15e46793f8d","6158eb913466","55f1c20aba7a","3d18b94f6858","4861fee224fd","63c6f1f93ee","1d98b3a9a871","decb52b64abf","ae5d4995e225","830cded25262"],"topicToTagMappings":{"accessibility":"accessibility","addiction":"addiction","android-development":"android-development","art":"art","artificial-intelligence":"artificial-intelligence","astrology":"astrology","basic-income":"basic-income","beauty":"beauty","biotech":"biotech","blockchain":"blockchain","books":"books","business":"business","cannabis":"cannabis","cities":"cities","climate-change":"climate-change","comics":"comics","coronavirus":"coronavirus","creativity":"creativity","cryptocurrency":"cryptocurrency","culture":"culture","cybersecurity":"cybersecurity","data-science":"data-science","design":"design","digital-life":"digital-life","disability":"disability","economy":"economy","education":"education","equality":"equality","family":"family","feminism":"feminism","fiction":"fiction","film":"film","fitness":"fitness","food":"food","freelancing":"freelancing","future":"future","gadgets":"gadgets","gaming":"gaming","gun-control":"gun-control","health":"health","history":"history","humor":"humor","immigration":"immigration","ios-development":"ios-development","javascript":"javascript","justice":"justice","language":"language","leadership":"leadership","lgbtqia":"lgbtqia","lifestyle":"lifestyle","machine-learning":"machine-learning","makers":"makers","marketing":"marketing","math":"math","media":"media","mental-health":"mental-health","mindfulness":"mindfulness","money":"money","music":"music","neuroscience":"neuroscience","nonfiction":"nonfiction","outdoors":"outdoors","parenting":"parenting","pets":"pets","philosophy":"philosophy","photography":"photography","podcasts":"podcast","poetry":"poetry","politics":"politics","privacy":"privacy","product-management":"product-management","productivity":"productivity","programming":"programming","psychedelics":"psychedelics","psychology":"psychology","race":"race","relationships":"relationships","religion":"religion","remote-work":"remote-work","san-francisco":"san-francisco","science":"science","self":"self","self-driving-cars":"self-driving-cars","sexuality":"sexuality","social-media":"social-media","society":"society","software-engineering":"software-engineering","space":"space","spirituality":"spirituality","sports":"sports","startups":"startup","style":"style","technology":"technology","transportation":"transportation","travel":"travel","true-crime":"true-crime","tv":"tv","ux":"ux","venture-capital":"venture-capital","visual-design":"visual-design","work":"work","world":"world","writing":"writing"},"defaultImages":{"avatar":{"imageId":"1*dmbNkD5D-u45r44go_cf0g.png","height":150,"width":150},"orgLogo":{"imageId":"7*V1_7XP4snlmqrc_0Njontw.png","height":110,"width":500},"postLogo":{"imageId":"bd978bb536350a710e8efb012513429cabdc4c28700604261aeda246d0f980b7","height":810,"width":1440},"postPreviewImage":{"imageId":"1*hn4v1tCaJy7cWMyb0bpNpQ.png","height":386,"width":579}},"collectionStructuredData":{"8d6b8a439e32":{"name":"Elemental","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fcdn-images-1.medium.com\u002Fmax\u002F980\u002F1*9ygdqoKprhwuTVKUM0DLPA@2x.png","width":980,"height":159}}},"3f6ecf56618":{"name":"Forge","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fcdn-images-1.medium.com\u002Fmax\u002F596\u002F1*uULpIlImcO5TDuBZ6lm7Lg@2x.png","width":596,"height":183}}},"ae2a65f35510":{"name":"GEN","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fmiro.medium.com\u002Fmax\u002F264\u002F1*RdVZMdvfV3YiZTw6mX7yWA.png","width":264,"height":140}}},"88d9857e584e":{"name":"LEVEL","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fmiro.medium.com\u002Fmax\u002F540\u002F1*JqYMhNX6KNNb2UlqGqO2WQ.png","width":540,"height":108}}},"7b6769f2748b":{"name":"Marker","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fcdn-images-1.medium.com\u002Fmax\u002F383\u002F1*haCUs0wF6TgOOvfoY-jEoQ@2x.png","width":383,"height":92}}},"444d13b52878":{"name":"OneZero","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fmiro.medium.com\u002Fmax\u002F540\u002F1*cw32fIqCbRWzwJaoQw6BUg.png","width":540,"height":123}}},"8ccfed20cbb2":{"name":"Zora","data":{"@type":"NewsMediaOrganization","ethicsPolicy":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Farticles\u002F360043290473","logo":{"@type":"ImageObject","url":"https:\u002F\u002Fmiro.medium.com\u002Fmax\u002F540\u002F1*tZUQqRcCCZDXjjiZ4bDvgQ.png","width":540,"height":106}}}},"embeddedPostIds":{"coronavirus":"cd3010f9d81f"},"sharedCdcMessaging":{"COVID_APPLICABLE_TAG_SLUGS":[],"COVID_APPLICABLE_TOPIC_NAMES":[],"COVID_APPLICABLE_TOPIC_NAMES_FOR_TOPIC_PAGE":[],"COVID_MESSAGES":{"tierA":{"text":"For more information on the novel coronavirus and Covid-19, visit cdc.gov.","markups":[{"start":66,"end":73,"href":"https:\u002F\u002Fwww.cdc.gov\u002Fcoronavirus\u002F2019-nCoV"}]},"tierB":{"text":"Anyone can publish on Medium per our Policies, but we don’t fact-check every story. For more info about the coronavirus, see cdc.gov.","markups":[{"start":37,"end":45,"href":"https:\u002F\u002Fhelp.medium.com\u002Fhc\u002Fen-us\u002Fcategories\u002F201931128-Policies-Safety"},{"start":125,"end":132,"href":"https:\u002F\u002Fwww.cdc.gov\u002Fcoronavirus\u002F2019-nCoV"}]},"paywall":{"text":"This article has been made free for everyone, thanks to Medium Members. For more information on the novel coronavirus and Covid-19, visit cdc.gov.","markups":[{"start":56,"end":70,"href":"https:\u002F\u002Fmedium.com\u002Fmembership"},{"start":138,"end":145,"href":"https:\u002F\u002Fwww.cdc.gov\u002Fcoronavirus\u002F2019-nCoV"}]},"unbound":{"text":"This article is free for everyone, thanks to Medium Members. For more information on the novel coronavirus and Covid-19, visit cdc.gov.","markups":[{"start":45,"end":59,"href":"https:\u002F\u002Fmedium.com\u002Fmembership"},{"start":127,"end":134,"href":"https:\u002F\u002Fwww.cdc.gov\u002Fcoronavirus\u002F2019-nCoV"}]}},"COVID_BANNER_POST_ID_OVERRIDE_WHITELIST":["3b31a67bff4a"]},"sharedVoteMessaging":{"TAGS":["politics","election-2020","government","us-politics","election","2020-presidential-race","trump","donald-trump","democrats","republicans","congress","republican-party","democratic-party","biden","joe-biden","maga"],"TOPICS":["politics","election"],"MESSAGE":{"text":"Find out more about the U.S. election results here.","markups":[{"start":46,"end":50,"href":"https:\u002F\u002Fcookpolitical.com\u002F2020-national-popular-vote-tracker"}]},"EXCLUDE_POSTS":["397ef29e3ca5"]},"embedPostRules":[],"recircOptions":{"v1":{"limit":3},"v2":{"limit":8}},"braintreeClientKey":"production_zjkj96jm_m56f8fqpf7ngnrd4","braintree":{"enabled":true,"merchantId":"m56f8fqpf7ngnrd4","merchantAccountId":{"usd":"AMediumCorporation_instant","eur":"amediumcorporation_EUR","cad":"amediumcorporation_CAD"},"publicKey":"ds2nn34bg2z7j5gd","braintreeEnvironment":"production","dashboardUrl":"https:\u002F\u002Fwww.braintreegateway.com\u002Fmerchants","gracePeriodDurationInDays":14,"mediumMembershipPlanId":{"monthly":"ce105f8c57a3","monthlyV2":"e8a5e126-792b-4ee6-8fba-d574c1b02fc5","monthlyWithTrial":"d5ee3dbe3db8","monthlyPremium":"fa741a9b47a2","yearly":"a40ad4a43185","yearlyV2":"3815d7d6-b8ca-4224-9b8c-182f9047866e","yearlyStaff":"d74fb811198a","yearlyWithTrial":"b3bc7350e5c7","yearlyPremium":"e21bd2c12166","monthlyOneYearFree":"e6c0637a-2bad-4171-ab4f-3c268633d83c","monthly25PercentOffFirstYear":"235ecc62-0cdb-49ae-9378-726cd21c504b","monthly20PercentOffFirstYear":"ba518864-9c13-4a99-91ca-411bf0cac756","monthly15PercentOffFirstYear":"594c029b-9f89-43d5-88f8-8173af4e070e","monthly10PercentOffFirstYear":"c6c7bc9a-40f2-4b51-8126-e28511d5bdb0","monthlyForStudents":"629ebe51-da7d-41fd-8293-34cd2f2030a8","yearlyOneYearFree":"78ba7be9-0d9f-4ece-aa3e-b54b826f2bf1","yearly25PercentOffFirstYear":"2dbb010d-bb8f-4eeb-ad5c-a08509f42d34","yearly20PercentOffFirstYear":"47565488-435b-47f8-bf93-40d5fbe0ebc8","yearly15PercentOffFirstYear":"8259809b-0881-47d9-acf7-6c001c7f720f","yearly10PercentOffFirstYear":"9dd694fb-96e1-472c-8d9e-3c868d5c1506","yearlyForStudents":"e29345ef-ab1c-4234-95c5-70e50fe6bc23","monthlyCad":"p52orjkaceei","yearlyCad":"h4q9g2up9ktt"},"braintreeDiscountId":{"oneMonthFree":"MONTHS_FREE_01","threeMonthsFree":"MONTHS_FREE_03","sixMonthsFree":"MONTHS_FREE_06","fiftyPercentOffOneYear":"FIFTY_PERCENT_OFF_ONE_YEAR"},"3DSecureVersion":"2","defaultCurrency":"usd","providerPlanIdCurrency":{"4ycw":"usd","rz3b":"usd","3kqm":"usd","jzw6":"usd","c2q2":"usd","nnsw":"usd","q8qw":"usd","d9y6":"usd","fx7w":"cad","nwf2":"cad"}},"paypalClientId":"AXj1G4fotC2GE8KzWX9mSxCH1wmPE3nJglf4Z2ig_amnhvlMVX87otaq58niAg9iuLktVNF_1WCMnN7v","paypal":{"host":"https:\u002F\u002Fapi.paypal.com:443","clientMode":"production","serverMode":"live","webhookId":"4G466076A0294510S","monthlyPlan":{"planId":"P-9WR0658853113943TMU5FDQA","name":"Medium Membership (Monthly) with setup fee","description":"Unlimited access to the best and brightest stories on Medium. Membership billed monthly."},"yearlyPlan":{"planId":"P-7N8963881P8875835MU5JOPQ","name":"Medium Membership (Annual) with setup fee","description":"Unlimited access to the best and brightest stories on Medium. Membership billed annually."},"oneYearGift":{"name":"Medium Membership (1 Year, Digital Gift Code)","description":"Unlimited access to the best and brightest stories on Medium. Gift codes can be redeemed at medium.com\u002Fredeem.","price":"50.00","currency":"USD","sku":"membership-gift-1-yr"},"oldMonthlyPlan":{"planId":"P-96U02458LM656772MJZUVH2Y","name":"Medium Membership (Monthly)","description":"Unlimited access to the best and brightest stories on Medium. Membership billed monthly."},"oldYearlyPlan":{"planId":"P-59P80963JF186412JJZU3SMI","name":"Medium Membership (Annual)","description":"Unlimited access to the best and brightest stories on Medium. Membership billed annually."},"monthlyPlanWithTrial":{"planId":"P-66C21969LR178604GJPVKUKY","name":"Medium Membership (Monthly) with setup fee","description":"Unlimited access to the best and brightest stories on Medium. Membership billed monthly."},"yearlyPlanWithTrial":{"planId":"P-6XW32684EX226940VKCT2MFA","name":"Medium Membership (Annual) with setup fee","description":"Unlimited access to the best and brightest stories on Medium. Membership billed annually."},"oldMonthlyPlanNoSetupFee":{"planId":"P-4N046520HR188054PCJC7LJI","name":"Medium Membership (Monthly)","description":"Unlimited access to the best and brightest stories on Medium. Membership billed monthly."},"oldYearlyPlanNoSetupFee":{"planId":"P-7A4913502Y5181304CJEJMXQ","name":"Medium Membership (Annual)","description":"Unlimited access to the best and brightest stories on Medium. Membership billed annually."},"sdkUrl":"https:\u002F\u002Fwww.paypal.com\u002Fsdk\u002Fjs"},"stripePublishableKey":"pk_live_7FReX44VnNIInZwrIIx6ghjl","log":{"json":true,"level":"info"},"imageUploadMaxSizeMb":25,"staffPicks":{"title":"Staff Picks","catalogId":"c7bc6e1ee00f"}},"session":{"xsrf":""}}</script><script>window.__APOLLO_STATE__ = {"ROOT_QUERY":{"__typename":"Query","viewer":null,"collectionByDomainOrSlug({\"domainOrSlug\":\"mitre-attack\"})":{"__ref":"Collection:6da19bd08fba"},"postResult({\"id\":\"7743870b37e3\"})":{"__ref":"Post:7743870b37e3"}},"ImageMetadata:":{"__typename":"ImageMetadata","id":""},"Collection:6da19bd08fba":{"__typename":"Collection","id":"6da19bd08fba","favicon":{"__ref":"ImageMetadata:"},"customStyleSheet":null,"colorPalette":{"__typename":"ColorPalette","highlightSpectrum":{"__typename":"ColorSpectrum","backgroundColor":"#FFFFFFFF","colorPoints":[{"__typename":"ColorPoint","color":"#FFFFE3D3","point":0},{"__typename":"ColorPoint","color":"#FFFFDECB","point":0.1},{"__typename":"ColorPoint","color":"#FFFFD9C4","point":0.2},{"__typename":"ColorPoint","color":"#FFFFD4BD","point":0.3},{"__typename":"ColorPoint","color":"#FFFFD0B5","point":0.4},{"__typename":"ColorPoint","color":"#FFFFCBAE","point":0.5},{"__typename":"ColorPoint","color":"#FFFFC6A7","point":0.6},{"__typename":"ColorPoint","color":"#FFFFC1A0","point":0.7},{"__typename":"ColorPoint","color":"#FFFFBC99","point":0.8},{"__typename":"ColorPoint","color":"#FFFFB792","point":0.9},{"__typename":"ColorPoint","color":"#FFFFB18B","point":1}]},"defaultBackgroundSpectrum":{"__typename":"ColorSpectrum","backgroundColor":"#FFFFFFFF","colorPoints":[{"__typename":"ColorPoint","color":"#FFDA4E2A","point":0},{"__typename":"ColorPoint","color":"#FFCA4A29","point":0.1},{"__typename":"ColorPoint","color":"#FFB94628","point":0.2},{"__typename":"ColorPoint","color":"#FFA84227","point":0.3},{"__typename":"ColorPoint","color":"#FF973D25","point":0.4},{"__typename":"ColorPoint","color":"#FF863823","point":0.5},{"__typename":"ColorPoint","color":"#FF753220","point":0.6},{"__typename":"ColorPoint","color":"#FF632B1C","point":0.7},{"__typename":"ColorPoint","color":"#FF512417","point":0.8},{"__typename":"ColorPoint","color":"#FF3E1B12","point":0.9},{"__typename":"ColorPoint","color":"#FF2A120B","point":1}]},"tintBackgroundSpectrum":{"__typename":"ColorSpectrum","backgroundColor":"#FFC63F1D","colorPoints":[{"__typename":"ColorPoint","color":"#FFC63F1D","point":0},{"__typename":"ColorPoint","color":"#FFD65331","point":0.1},{"__typename":"ColorPoint","color":"#FFE46644","point":0.2},{"__typename":"ColorPoint","color":"#FFF17858","point":0.3},{"__typename":"ColorPoint","color":"#FFFC8B6B","point":0.4},{"__typename":"ColorPoint","color":"#FFFF9C7F","point":0.5},{"__typename":"ColorPoint","color":"#FFFFAE93","point":0.6},{"__typename":"ColorPoint","color":"#FFFFBFA7","point":0.7},{"__typename":"ColorPoint","color":"#FFFFD0BB","point":0.8},{"__typename":"ColorPoint","color":"#FFFFE1D0","point":0.9},{"__typename":"ColorPoint","color":"#FFFFF2E4","point":1}]}},"domain":null,"slug":"mitre-attack","googleAnalyticsId":null,"name":"MITRE ATT&CK®","avatar":{"__ref":"ImageMetadata:1*Y6LKGEIzmF96lVHkv_RS9A.png"},"description":"This is the official blog for MITRE ATT&CK®, the MITRE-developed, globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. The full website is located at https:\u002F\u002Fattack.mitre.org.","subscriberCount":6661,"latestPostsConnection({\"paging\":{\"limit\":1}})":{"__typename":"PostConnection","posts":[{"__ref":"Post:561c76af94cf"}]},"isAuroraVisible":false,"tintColor":"#FFC63F1D","newsletterV3":null,"viewerEdge":{"__ref":"CollectionViewerEdge:collectionId:6da19bd08fba-viewerId:lo_8a916a877da1"},"twitterUsername":"mitreattack","facebookPageId":null,"logo":{"__ref":"ImageMetadata:1*8epIYX1PfgfnVfDYfZ5loQ.png"}},"ImageMetadata:1*Y6LKGEIzmF96lVHkv_RS9A.png":{"__typename":"ImageMetadata","id":"1*Y6LKGEIzmF96lVHkv_RS9A.png"},"User:13b16fa8065d":{"__typename":"User","id":"13b16fa8065d","customDomainState":null,"hasSubdomain":false,"username":"arobertson_79988","linkedAccounts":{"__ref":"LinkedAccounts:13b16fa8065d"},"isSuspended":false,"name":"Amy L. Robertson","imageId":"1*HSqNMSnjesj-UnJGDPJi7g.jpeg","verifications":{"__typename":"VerifiedInfo","isBookAuthor":false},"socialStats":{"__typename":"SocialStats","followerCount":633,"followingCount":4,"collectionFollowingCount":1},"bio":"","membership":null,"allowNotes":true,"viewerEdge":{"__ref":"UserViewerEdge:userId:13b16fa8065d-viewerId:lo_8a916a877da1"},"twitterScreenName":""},"Post:561c76af94cf":{"__typename":"Post","id":"561c76af94cf","firstPublishedAt":1730389403724,"creator":{"__ref":"User:13b16fa8065d"},"collection":{"__ref":"Collection:6da19bd08fba"},"isSeries":false,"mediumUrl":"https:\u002F\u002Fmedium.com\u002Fmitre-attack\u002Fattack-v16-561c76af94cf","sequence":null,"uniqueSlug":"attack-v16-561c76af94cf"},"LinkedAccounts:13b16fa8065d":{"__typename":"LinkedAccounts","mastodon":null,"id":"13b16fa8065d"},"ImageMetadata:1*aghj7RR33HlT_i1FVYx_eQ.jpeg":{"__typename":"ImageMetadata","id":"1*aghj7RR33HlT_i1FVYx_eQ.jpeg","originalHeight":312,"originalWidth":512,"focusPercentX":null,"focusPercentY":null,"alt":null},"Paragraph:49d927d50d9e_0":{"__typename":"Paragraph","id":"49d927d50d9e_0","name":"f7bd","type":"IMG","href":null,"layout":"INSET_CENTER","metadata":{"__ref":"ImageMetadata:1*aghj7RR33HlT_i1FVYx_eQ.jpeg"},"text":"","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_1":{"__typename":"Paragraph","id":"49d927d50d9e_1","name":"9221","type":"H3","href":null,"layout":null,"metadata":null,"text":"Introducing ATT&CK v10: More Objects, Parity, and Features","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"STRONG","start":0,"end":58,"href":null,"anchorType":null,"userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_2":{"__typename":"Paragraph","id":"49d927d50d9e_2","name":"cda8","type":"P","href":null,"layout":null,"metadata":null,"text":"By Amy L. Robertson (MITRE), Alexia Crumpton (MITRE), and Chris Ante (MITRE)","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":3,"end":19,"href":null,"anchorType":"USER","userId":"13b16fa8065d","linkMetadata":null},{"__typename":"Markup","type":"A","start":29,"end":44,"href":null,"anchorType":"USER","userId":"35dc9bd08e61","linkMetadata":null},{"__typename":"Markup","type":"A","start":58,"end":68,"href":null,"anchorType":"USER","userId":"d182dc9a9096","linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_3":{"__typename":"Paragraph","id":"49d927d50d9e_3","name":"6eeb","type":"P","href":null,"layout":null,"metadata":null,"text":"As announced a couple of weeks ago, we’re back with the latest release and we’re thrilled to reveal all the updates and features waiting for you in ATT&CK v10. The v10 release includes the next episode in our data sources saga, as well as new content and our usual enhancements to (sub-)Techniques, Groups, and Software across Enterprise, Mobile and ICS, which you can find more details about on our release notes.","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":3,"end":12,"href":"https:\u002F\u002Ftwitter.com\u002FMITREattack\u002Fstatus\u002F1445060354703245321","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"A","start":400,"end":413,"href":"https:\u002F\u002Fattack.mitre.org\u002Fresources\u002Fupdates\u002Fupdates-october-2021\u002F","anchorType":"LINK","userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_4":{"__typename":"Paragraph","id":"49d927d50d9e_4","name":"7de2","type":"H3","href":null,"layout":null,"metadata":null,"text":"Making Sense of the New Data Sources: Episode II","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_5":{"__typename":"Paragraph","id":"49d927d50d9e_5","name":"6eb0","type":"P","href":null,"layout":null,"metadata":null,"text":"In ATT&CK v9, we launched the new form of data sources which featured an updated structure for the data source names (Data Source: Data Component), reflecting","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":30,"end":54,"href":"https:\u002F\u002Fmedium.com\u002Fmitre-attack\u002Fattack-april-2021-release-39accaf23c81","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"STRONG","start":118,"end":158,"href":null,"anchorType":null,"userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_6":{"__typename":"Paragraph","id":"49d927d50d9e_6","name":"5771","type":"P","href":null,"layout":null,"metadata":null,"text":"“What is the subject\u002Ftopic of the collected data (file, process, network traffic, etc.)?” :","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"STRONG","start":90,"end":91,"href":null,"anchorType":null,"userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_7":{"__typename":"Paragraph","id":"49d927d50d9e_7","name":"f4e2","type":"P","href":null,"layout":null,"metadata":null,"text":"“What specific values\u002Fproperties are needed in order to detect adversary behaviors?”","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_8":{"__typename":"Paragraph","id":"49d927d50d9e_8","name":"3a22","type":"P","href":null,"layout":null,"metadata":null,"text":"These updates were linked to Yaml files in GitHub, but weren’t fully integrated into the rest of ATT&CK yet. Our updated content in ATT&CK v10 aggregates this information about data sources, while structuring them as the new ATT&CK data source objects (somewhat similar to how Mitigations are reflected).","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":43,"end":49,"href":"https:\u002F\u002Fgithub.com\u002Fmitre-attack\u002Fattack-datasources","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"A","start":225,"end":251,"href":"https:\u002F\u002Fattack.mitre.org\u002Fdatasources\u002F","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"A","start":277,"end":288,"href":"https:\u002F\u002Fattack.mitre.org\u002Fmitigations\u002Fenterprise\u002F","anchorType":"LINK","userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_9":{"__typename":"Paragraph","id":"49d927d50d9e_9","name":"645c","type":"P","href":null,"layout":null,"metadata":null,"text":"The data source object features the name of the data source as well as key details and metadata, including an ID, a definition, where it can be collected (collection layer), what platform(s) it can be found on, and the data components highlighting relevant values\u002Fproperties that comprise the data source. Featured below is an example of a data source page in ATT&CK v10.","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"ImageMetadata:1*LLlBzThlt8No2Wvxh8R9Ew.png":{"__typename":"ImageMetadata","id":"1*LLlBzThlt8No2Wvxh8R9Ew.png","originalHeight":516,"originalWidth":982,"focusPercentX":null,"focusPercentY":null,"alt":null},"Paragraph:49d927d50d9e_10":{"__typename":"Paragraph","id":"49d927d50d9e_10","name":"d6f8","type":"IMG","href":null,"layout":"INSET_CENTER","metadata":{"__ref":"ImageMetadata:1*LLlBzThlt8No2Wvxh8R9Ew.png"},"text":"Figure 1: Network Traffic Data Source Page","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_11":{"__typename":"Paragraph","id":"49d927d50d9e_11","name":"03f6","type":"P","href":null,"layout":null,"metadata":null,"text":"Data Components are also listed below, each highlighting mappings to the various (sub-)techniques that may be detected with that particular data. On individual (sub-)techniques, data sources and components have been relocated from the metadata box at the top of the page to be collocated with Detection content.","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"ImageMetadata:1*lGqNBMvtaXAXWP1K2jQO8A.png":{"__typename":"ImageMetadata","id":"1*lGqNBMvtaXAXWP1K2jQO8A.png","originalHeight":350,"originalWidth":962,"focusPercentX":null,"focusPercentY":null,"alt":null},"Paragraph:49d927d50d9e_12":{"__typename":"Paragraph","id":"49d927d50d9e_12","name":"d69d","type":"IMG","href":null,"layout":"INSET_CENTER","metadata":{"__ref":"ImageMetadata:1*lGqNBMvtaXAXWP1K2jQO8A.png"},"text":"Figure 2: New Data Source Placement on Technique (T1055.001) Page","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_13":{"__typename":"Paragraph","id":"49d927d50d9e_13","name":"1a87","type":"P","href":null,"layout":null,"metadata":null,"text":"These data sources are available for all platforms of Enterprise ATT&CK, including our newest additions that cover OSINT-related data sources mapped to PRE platform techniques.","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"ImageMetadata:1*TzINk4g4jaMGCxtIJ9rpsg.png":{"__typename":"ImageMetadata","id":"1*TzINk4g4jaMGCxtIJ9rpsg.png","originalHeight":538,"originalWidth":990,"focusPercentX":null,"focusPercentY":null,"alt":null},"Paragraph:49d927d50d9e_14":{"__typename":"Paragraph","id":"49d927d50d9e_14","name":"2733","type":"IMG","href":null,"layout":"INSET_CENTER","metadata":{"__ref":"ImageMetadata:1*TzINk4g4jaMGCxtIJ9rpsg.png"},"text":"Figure 4: Malware Repository Data Source Page","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_15":{"__typename":"Paragraph","id":"49d927d50d9e_15","name":"3fff","type":"P","href":null,"layout":null,"metadata":null,"text":"These updated structures are also visible in ATT&CK’s STIX representation, with both the data sources and the data components captured as custom STIX objects. You’ll be able to see the relationships between those objects, with the data sources featuring one or more data components, each of which detects one or more techniques. For more information about ATT&CK’s STIX representation, including these new objects and relationships, you can check out our STIX usage document.","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":45,"end":73,"href":"https:\u002F\u002Fgithub.com\u002Fmitre\u002Fcti","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"A","start":455,"end":474,"href":"https:\u002F\u002Fgithub.com\u002Fmitre\u002Fcti\u002Fblob\u002Fmaster\u002FUSAGE.md","anchorType":"LINK","userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_16":{"__typename":"Paragraph","id":"49d927d50d9e_16","name":"f1d3","type":"IMG","href":null,"layout":"INSET_CENTER","metadata":{"__ref":"ImageMetadata:1*aghj7RR33HlT_i1FVYx_eQ.jpeg"},"text":"Figure 5: Data Source STIX Model","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_17":{"__typename":"Paragraph","id":"49d927d50d9e_17","name":"e176","type":"P","href":null,"layout":null,"metadata":null,"text":"We hope that these enhancements further increase our ability to translate our understanding of the adversary behaviors captured within ATT&CK to the data we collect as defenders. We are very excited to see these data source objects grow and evolve, and like the rest of ATT&CK, invite the community to submit contributions and feedback!","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_18":{"__typename":"Paragraph","id":"49d927d50d9e_18","name":"f9f6","type":"P","href":null,"layout":null,"metadata":null,"text":"Note: We will no longer be working with Enterprise data sources in GitHub after ATT&CK v10. Moving forward we will accept all related contributions through our normal contribution process.","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":160,"end":187,"href":"https:\u002F\u002Fattack.mitre.org\u002Fresources\u002Fcontribute\u002F","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"STRONG","start":0,"end":5,"href":null,"anchorType":null,"userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_19":{"__typename":"Paragraph","id":"49d927d50d9e_19","name":"b8ec","type":"H3","href":null,"layout":null,"metadata":null,"text":"MacOS and Linux: Now with New Content!","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_20":{"__typename":"Paragraph","id":"49d927d50d9e_20","name":"78cc","type":"P","href":null,"layout":null,"metadata":null,"text":"Over the past several months, we’ve been continuing to improve and expand coverage across the macOS and Linux platforms. We understand adversaries actively target these platforms, however there is significantly less public reporting for adversarial hands-on-keyboard procedures and malware analysis. We’re pleased to report that we’ve been collaborating with macOS security and vulnerability research contributors across the globe to address these challenges. In upcoming releases, we’re hoping to leverage this same community engagement for Linux. We’re excited to see the growth in content from the community’s contribution, and the improvements ranging from how we capture new techniques to conveying the impact of existing techniques was a collaborative effort.","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":94,"end":99,"href":"https:\u002F\u002Fattack.mitre.org\u002Fmatrices\u002Fenterprise\u002Fmacos\u002F","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"A","start":104,"end":109,"href":"https:\u002F\u002Fattack.mitre.org\u002Fmatrices\u002Fenterprise\u002Flinux\u002F","anchorType":"LINK","userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_21":{"__typename":"Paragraph","id":"49d927d50d9e_21","name":"7d75","type":"P","href":null,"layout":null,"metadata":null,"text":"One of the most notable changes we made for techniques across the board was providing more in-depth references and use-cases on how procedures and processes work, and the impact they have. Remote services along with additional techniques for macOS and Linux received some attention, but most improvements were more detailed examples in the description section with supporting detection ideas. Along with the rest of Enterprise, we also updated our macOS data sources to enhance defender visibility.","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_22":{"__typename":"Paragraph","id":"49d927d50d9e_22","name":"776b","type":"H3","href":null,"layout":null,"metadata":null,"text":"ICS : Object-Oriented and Integrating","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"STRONG","start":0,"end":3,"href":null,"anchorType":null,"userId":null,"linkMetadata":null},{"__typename":"Markup","type":"STRONG","start":4,"end":37,"href":null,"anchorType":null,"userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_23":{"__typename":"Paragraph","id":"49d927d50d9e_23","name":"f32d","type":"P","href":null,"layout":null,"metadata":null,"text":"ICS has been focusing on feature equity with Enterprise, including updating data sources, adding and refining techniques, revamping assets, and charting out our detections plan. We’re also making some key changes to facilitate hunting in ICS environments. As we noted in the 2021 Roadmap, v10 also includes cross-domain mappings of Enterprise techniques to software that were previously only represented in the ICS Matrix, including Stuxnet, Industroyer, and several others. The fact that adversaries don’t respect theoretical boundaries is something we’ve consistently emphasized, and we think it’s crucial to feature Enterprise-centric mappings for more comprehensive coverage of all the behaviors exhibited by the software. With Stuxnet and Industroyer specifically, both malware operated within OT\u002FICS networks, but the two incidents displayed techniques that are also well researched and represented within the Enterprise matrix. Based on this, we created Enterprise entries for the ICS-focused software to provide network defenders with a view of software behavior spanning both matrices. We also expect the cross-domain mappings to enable you to leverage the knowledge bases together more effectively.","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":275,"end":287,"href":"https:\u002F\u002Fmedium.com\u002Fmitre-attack\u002Fatt-ck-2021-roadmap-68bab3886fa2","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"A","start":475,"end":580,"href":"https:\u002F\u002Fmedium.com\u002Fmitre-attack\u002Fin-pursuit-of-a-gestalt-visualization-merging-mitre-att-ck-for-enterprise-and-ics-to-communicate-3523daa7b580","anchorType":"LINK","userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_24":{"__typename":"Paragraph","id":"49d927d50d9e_24","name":"822f","type":"P","href":null,"layout":null,"metadata":null,"text":"For data sources, we’re aligning with Enterprise ATT&CK in updating data source names. ICS’s current release reflects Enterprise’s v9 data sources update, with the new name format and content featured in GitHub. These data sources will be linked to YAML files that provide more detail, including what the data sources are and how they should be used. For future releases we plan on mapping the more granular assets to techniques to enable you to track how these behaviors can affect a technique, or what assets these behaviors are associated with. On the detections front, we’re working behind the scenes to add detections to each technique, and this will be reflected in future releases (we expect detections to really help out in hunt and continuous monitoring). Also in 2022, we’re preparing to integrate onto the same development platform as Enterprise, the ATT&CK Workbench, and join the rest of the domains on the ATT&CK website (attack.mitre.org).","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":408,"end":414,"href":"https:\u002F\u002Fcollaborate.mitre.org\u002Fattackics\u002Findex.php\u002FAll_Assets","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"A","start":862,"end":878,"href":"https:\u002F\u002Fctid.mitre-engenuity.org\u002Four-work\u002Fattack-workbench\u002F","anchorType":"LINK","userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_25":{"__typename":"Paragraph","id":"49d927d50d9e_25","name":"c8cf","type":"H3","href":null,"layout":null,"metadata":null,"text":"Expanding Our Mobile Features","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_26":{"__typename":"Paragraph","id":"49d927d50d9e_26","name":"4f76","type":"P","href":null,"layout":null,"metadata":null,"text":"In the Mobile space, we’ve been focused on catching up on the contributions from the community, updating (sub-)techniques, Groups, and Software, and enhancing general parity with Enterprise. We’ve also been working hard behind the scenes to implement sub-techniques as mentioned in our 2021 Roadmap. We’re excited to introduce this new Mobile structure in April 2022, to better align with other platforms on Enterprise. Our plan is to do a beta release for the sub-techniques prior to the release of v11 to provide you with an opportunity to test out those updates and provide feedback.","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":286,"end":298,"href":"https:\u002F\u002Fmedium.com\u002Fmitre-attack\u002Fatt-ck-2021-roadmap-68bab3886fa2","anchorType":"LINK","userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_27":{"__typename":"Paragraph","id":"49d927d50d9e_27","name":"519d","type":"H3","href":null,"layout":null,"metadata":null,"text":"About Cloud","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_28":{"__typename":"Paragraph","id":"49d927d50d9e_28","name":"c219","type":"P","href":null,"layout":null,"metadata":null,"text":"Along with the rest of Enterprise, we’ve been updating content across Cloud, collaborating with community members on activity in the Cloud domain, and keeping an eye out for new platforms to add to the space. We also continued working on data sources, although as we outlined for the v9 release, our Cloud data sources are a little different than the host-based data sources, specifically aligning more with the events and APIs involved in detections instead of just focusing on the log sources.","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_29":{"__typename":"Paragraph","id":"49d927d50d9e_29","name":"17e5","type":"H3","href":null,"layout":null,"metadata":null,"text":"What’s Next in 2022?","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_30":{"__typename":"Paragraph","id":"49d927d50d9e_30","name":"9990","type":"P","href":null,"layout":null,"metadata":null,"text":"We hope you’re as excited as we are about v10, and we’d love your feedback and for you to join us in shaping our v11 release. We already have a lot on the horizon for 2022, included structured detections, campaigns, tools to enable overlays and combinations, and ATT&CKcon. If you have feedback, comments, contributions, or just want to ask questions, connect with us on email, Twitter, or Slack.","hasDropCap":null,"dropCapImage":null,"markups":[{"__typename":"Markup","type":"A","start":372,"end":377,"href":"mailto:attack@mitre.org","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"A","start":379,"end":386,"href":"https:\u002F\u002Ftwitter.com\u002FMITREattack?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor","anchorType":"LINK","userId":null,"linkMetadata":null},{"__typename":"Markup","type":"A","start":391,"end":396,"href":"https:\u002F\u002Fjoin.slack.com\u002Ft\u002Fmitreattack\u002Fshared_invite\u002Fzt-ny1a3yon-XkT_OS1IF~ZYrESq8Xtqjg","anchorType":"LINK","userId":null,"linkMetadata":null}],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"Paragraph:49d927d50d9e_31":{"__typename":"Paragraph","id":"49d927d50d9e_31","name":"e63e","type":"P","href":null,"layout":null,"metadata":null,"text":"©2021 The MITRE Corporation. ALL RIGHTS RESERVED. Approved for public release. Distribution unlimited 21–00706–18.","hasDropCap":null,"dropCapImage":null,"markups":[],"codeBlockMetadata":null,"iframe":null,"mixtapeMetadata":null},"CollectionViewerEdge:collectionId:6da19bd08fba-viewerId:lo_8a916a877da1":{"__typename":"CollectionViewerEdge","id":"collectionId:6da19bd08fba-viewerId:lo_8a916a877da1","isEditor":false,"isMuting":false},"UserViewerEdge:userId:13b16fa8065d-viewerId:lo_8a916a877da1":{"__typename":"UserViewerEdge","id":"userId:13b16fa8065d-viewerId:lo_8a916a877da1","isMuting":false},"ImageMetadata:1*8epIYX1PfgfnVfDYfZ5loQ.png":{"__typename":"ImageMetadata","id":"1*8epIYX1PfgfnVfDYfZ5loQ.png","originalWidth":796,"originalHeight":164},"PostViewerEdge:postId:7743870b37e3-viewerId:lo_8a916a877da1":{"__typename":"PostViewerEdge","shouldIndexPostForExternalSearch":true,"id":"postId:7743870b37e3-viewerId:lo_8a916a877da1"},"Tag:attck-v10":{"__typename":"Tag","id":"attck-v10","displayTitle":"Attck V10","normalizedTagSlug":"attck-v10"},"Tag:attck-release":{"__typename":"Tag","id":"attck-release","displayTitle":"Attck Release","normalizedTagSlug":"attck-release"},"Tag:data-sources":{"__typename":"Tag","id":"data-sources","displayTitle":"Data Sources","normalizedTagSlug":"datasource"},"Tag:release-notes":{"__typename":"Tag","id":"release-notes","displayTitle":"Release Notes","normalizedTagSlug":"release-notes"},"Post:7743870b37e3":{"__typename":"Post","id":"7743870b37e3","collection":{"__ref":"Collection:6da19bd08fba"},"content({\"postMeteringOptions\":{\"referrer\":\"\"}})":{"__typename":"PostContent","isLockedPreviewOnly":false,"bodyModel":{"__typename":"RichText","sections":[{"__typename":"Section","name":"ae52","startIndex":0,"textLayout":null,"imageLayout":null,"backgroundImage":null,"videoLayout":null,"backgroundVideo":null}],"paragraphs":[{"__ref":"Paragraph:49d927d50d9e_0"},{"__ref":"Paragraph:49d927d50d9e_1"},{"__ref":"Paragraph:49d927d50d9e_2"},{"__ref":"Paragraph:49d927d50d9e_3"},{"__ref":"Paragraph:49d927d50d9e_4"},{"__ref":"Paragraph:49d927d50d9e_5"},{"__ref":"Paragraph:49d927d50d9e_6"},{"__ref":"Paragraph:49d927d50d9e_7"},{"__ref":"Paragraph:49d927d50d9e_8"},{"__ref":"Paragraph:49d927d50d9e_9"},{"__ref":"Paragraph:49d927d50d9e_10"},{"__ref":"Paragraph:49d927d50d9e_11"},{"__ref":"Paragraph:49d927d50d9e_12"},{"__ref":"Paragraph:49d927d50d9e_13"},{"__ref":"Paragraph:49d927d50d9e_14"},{"__ref":"Paragraph:49d927d50d9e_15"},{"__ref":"Paragraph:49d927d50d9e_16"},{"__ref":"Paragraph:49d927d50d9e_17"},{"__ref":"Paragraph:49d927d50d9e_18"},{"__ref":"Paragraph:49d927d50d9e_19"},{"__ref":"Paragraph:49d927d50d9e_20"},{"__ref":"Paragraph:49d927d50d9e_21"},{"__ref":"Paragraph:49d927d50d9e_22"},{"__ref":"Paragraph:49d927d50d9e_23"},{"__ref":"Paragraph:49d927d50d9e_24"},{"__ref":"Paragraph:49d927d50d9e_25"},{"__ref":"Paragraph:49d927d50d9e_26"},{"__ref":"Paragraph:49d927d50d9e_27"},{"__ref":"Paragraph:49d927d50d9e_28"},{"__ref":"Paragraph:49d927d50d9e_29"},{"__ref":"Paragraph:49d927d50d9e_30"},{"__ref":"Paragraph:49d927d50d9e_31"}]},"validatedShareKey":"","shareKeyCreator":null},"creator":{"__ref":"User:13b16fa8065d"},"inResponseToEntityType":null,"isLocked":false,"isMarkedPaywallOnly":false,"lockedSource":"LOCKED_POST_SOURCE_NONE","mediumUrl":"https:\u002F\u002Fmedium.com\u002Fmitre-attack\u002Fintroducing-attack-v10-7743870b37e3","primaryTopic":null,"topics":[{"__typename":"Topic","slug":"cybersecurity"},{"__typename":"Topic","slug":"programming"}],"isLimitedState":false,"isPublished":true,"allowResponses":true,"latestPublishedVersion":"49d927d50d9e","visibility":"PUBLIC","postResponses":{"__typename":"PostResponses","count":0},"responseDistribution":"NOT_DISTRIBUTED","clapCount":63,"title":"Introducing ATT&CK v10: More Objects, Parity and Features","isSeries":false,"sequence":null,"uniqueSlug":"introducing-attack-v10-7743870b37e3","socialTitle":"","socialDek":"","canonicalUrl":"","metaDescription":"","latestPublishedAt":1634831437317,"readingTime":5.723899371069182,"previewContent":{"__typename":"PreviewContent","subtitle":"Detailing the content and feature updates just released in ATT&CK v10"},"previewImage":{"__ref":"ImageMetadata:1*aghj7RR33HlT_i1FVYx_eQ.jpeg"},"isShortform":false,"seoTitle":"Introducing ATT&CK v10: More Objects, Parity, and Features","firstPublishedAt":1634831437317,"updatedAt":1641331294086,"shortformType":"SHORTFORM_TYPE_LINK","seoDescription":"","viewerEdge":{"__ref":"PostViewerEdge:postId:7743870b37e3-viewerId:lo_8a916a877da1"},"isSuspended":false,"license":"ALL_RIGHTS_RESERVED","tags":[{"__ref":"Tag:attck-v10"},{"__ref":"Tag:attck-release"},{"__ref":"Tag:data-sources"},{"__ref":"Tag:release-notes"}],"isFeaturedInPublishedPublication":false,"isNewsletter":false,"statusForCollection":"APPROVED","pendingCollection":null,"detectedLanguage":"en","wordCount":1296,"layerCake":0,"responsesLocked":false}}</script><script>window.__MIDDLEWARE_STATE__={"session":{"xsrf":""},"cache":{"cacheStatus":"MISS"}}</script><script src="https://cdn-client.medium.com/lite/static/js/manifest.4b5fe151.js"></script><script src="https://cdn-client.medium.com/lite/static/js/9865.1496d74a.js"></script><script src="https://cdn-client.medium.com/lite/static/js/main.af7becea.js"></script><script src="https://cdn-client.medium.com/lite/static/js/instrumentation.5bef8967.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/reporting.ff22a7a5.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/9120.5df29668.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/5049.d1ead72d.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/4505.6dfaf853.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/6618.db187378.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/9380.fb176dee.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/2707.dc8dbee4.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/9977.933c1c9a.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/8599.68bc318b.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/3045.1cc3d8cb.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/6349.3329b100.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/2648.26563adf.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/8393.a4ecfb83.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/6428.7d30b23c.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/6199.6da73f3b.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/5642.7d9f7f3d.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/6546.67eb283b.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/6834.8aa8d357.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/4492.0c3e1a1d.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/2571.6814b962.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/839.1c286b32.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/6128.f8800a13.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/2135.2e8dc177.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/7975.60bcefe8.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/144.86429b48.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/5240.6281357f.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/8819.c627c2bf.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/8204.d0637ed0.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/PostPage.MainContent.a27c27dc.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/8414.0d800846.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/3974.8d3e0217.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/2527.18a8996d.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/PostResponsesContent.e1e580cb.chunk.js"></script> <script src="https://cdn-client.medium.com/lite/static/js/responses.editor.e89462cb.chunk.js"></script><script>window.main();</script><script>(function(){function c(){var b=a.contentDocument||a.contentWindow.document;if(b){var d=b.createElement('script');d.innerHTML="window.__CF$cv$params={r:'9138cf6b2e084027',t:'MTczOTgyNzExMS4wMDAwMDA='};var a=document.createElement('script');a.nonce='';a.src='/cdn-cgi/challenge-platform/scripts/jsd/main.js';document.getElementsByTagName('head')[0].appendChild(a);";b.getElementsByTagName('head')[0].appendChild(d)}}if(document.body){var a=document.createElement('iframe');a.height=1;a.width=1;a.style.position='absolute';a.style.top=0;a.style.left=0;a.style.border='none';a.style.visibility='hidden';document.body.appendChild(a);if('loading'!==document.readyState)c();else if(window.addEventListener)document.addEventListener('DOMContentLoaded',c);else{var e=document.onreadystatechange||function(){};document.onreadystatechange=function(b){e(b);'loading'!==document.readyState&&(document.onreadystatechange=e,c())}}}})();</script></body></html>