New version: MITRE ATT&CK Enterprise (20.0) – 27 new, 56 changed, 0 removed, 62 links
- Document: MITRE ATT&CK Enterprise (https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack-20.0.json)
- Version: 20.0
- Project: MITREATTACK
- Import: #480, 20.10.2026 11:17, mitre
The new version was compared with the existing issues. Changes are only applied once approved in the administration (Importer › Proposed changes).
Taken over directly (additional fields, HTML of an unchanged text): 4 issues.
Review: 0 open, 145 applied, 0 rejected.
New sections (27)
- Steal Application Specific Passwords [applied]
attack-pattern--6c427a0d-e0df-41f8-b522-e59eaab44c47 - Impair Autonomous Defenses [applied]
attack-pattern--6aa4bc38-0713-4d40-ad0b-949d912da852 - Indirect Prompt Injection [applied]
attack-pattern--2e45d340-f00b-4bd6-b5c9-c2ef54b8894c - Direct Prompt Injection [applied]
attack-pattern--d7e9cba9-3b43-4208-8e90-fdb18bff4a6a - Anti-Automation Evasion [applied]
attack-pattern--c5e8ef5d-e9b4-46b2-9dd8-afbb1c42090f - Automate CAPTCHA Completion [applied]
attack-pattern--d35b46b5-9be7-4a74-810b-2eabdd167fea - Avoid CAPTCHA [applied]
attack-pattern--d52e7766-3e2e-4500-8730-0bd1bb8f7eaf - AI-Enabled Exfiltration [applied]
attack-pattern--c0a6e9ec-9ef1-46b6-8a71-cc73863e8985 - AI Result Poisoning [applied]
attack-pattern--4484fb29-439d-4396-bbc3-4a7976710c1c - Analytic 2068 [applied]
x-mitre-analytic--6522e464-d3f5-45dd-bfbf-2759f3fa6de2 - Analytic 2074 [applied]
x-mitre-analytic--8020317a-d34b-4330-a1a8-2787d8d69fc1 - Analytic 2076 [applied]
x-mitre-analytic--05e6aaf5-12c3-480a-9baa-0d7d64b2a94a - Detection of AI Result Poisoning [applied]
x-mitre-detection-strategy--93aad346-455d-4de1-ae61-b11fd5456263 - Analytic 2070 [applied]
x-mitre-analytic--22cc5f6f-76b9-477b-b44e-7fe8a9a3fddb - Analytic 2075 [applied]
x-mitre-analytic--34dd92d1-edc3-42db-9507-760d82c42a5f - Analytic 2077 [applied]
x-mitre-analytic--b06e4fe7-c1de-407b-82cb-c3b1ecef3b8b - Suspicious Acquisition and Use of Application-Specific Passwords [applied]
x-mitre-detection-strategy--cbb2c861-8f0c-45ac-9005-4346e2ff6617 - Analytic 2104 [applied]
x-mitre-analytic--c3462a9e-35e2-4f7f-a132-d7379dd26eeb - Analytic 2105 [applied]
x-mitre-analytic--6db98b8e-a274-4ee2-8e10-cae17a4c855f - Detection of Automated CAPTCHA [applied]
x-mitre-detection-strategy--b91d85aa-d207-407e-b3dd-3adc4ed8fab0 - Detection of Avoid CAPTCHA [applied]
x-mitre-detection-strategy--211b4197-345a-4776-8391-0c368eb534e2 - Analytic 2106 [applied]
x-mitre-analytic--dde1f5e7-6aea-454c-9521-231257bb53c3 - Detection of Anti-Automation Evasion [applied]
x-mitre-detection-strategy--832681d0-1369-4915-a7b4-6627d7205a67 - Detect AI-Enabled Exfiltration [applied]
x-mitre-detection-strategy--0567c079-3df3-404a-b69d-1690efd638b4 - Analytic 2079 [applied]
x-mitre-analytic--d701cd5a-fa95-4c94-808b-ceb44120314d - Analytic 2078 [applied]
x-mitre-analytic--68906af9-7457-4285-9663-0d6ae7afccf4 - Analytic 2080 [applied]
x-mitre-analytic--5e07498b-9aba-41fa-bd95-212f9a9dc2fe
Changed sections (56)
- Enterprise ATT&CK – text [applied]
x-mitre-collection--1f5f1533-f617-4ca8-9ab4-6a02367fa019 - Remote Data Storage – text [applied]
course-of-action--20a2baeb-98c2-4901-bad7-dc62d0a03dea - SID-History Injection Mitigation – text [applied]
course-of-action--b91c2f9e-c1a0-44df-95f0-9e7c9d1d5e55 - Proc Filesystem – text [applied]
attack-pattern--3120b9fa-23b8-4500-ae73-09494f607b7d - Modify System Image – text [applied]
attack-pattern--ae7f3575-0a5e-427e-991b-fe03ad44c754 - Group Policy Modification – text [applied]
attack-pattern--5d2be8b9-d24c-4e98-83bf-2f5f79477163 - Execution – text [applied]
x-mitre-tactic--4ca45d45-df4d-4613-8980-bac22d278fa5 - PowerShell – text [applied]
attack-pattern--970a3432-3237-47ad-bcca-7d8cbb217736 - Defacement – text [applied]
attack-pattern--5909f20f-3c39-4795-be06-ef1ea40d350b - SSH Authorized Keys – text [applied]
attack-pattern--6b57dc31-b814-4a03-8706-28bc20d739c4 - Additional Cloud Credentials – text [applied]
attack-pattern--8a2f40cf-8325-47f9-96e4-b1ca4c7389bd - Image File Execution Options Injection – text [applied]
attack-pattern--6d4a7fb3-5a24-42be-ae61-6728a2b581f6 - SSH – text [applied]
attack-pattern--2db31dcd-54da-405d-acef-b9129b816ed6 - Run Virtual Instance – text [applied]
attack-pattern--b5327dd1-6bf9-4785-a199-25bcbd1f4a9d - Overwrite Process Arguments – text [applied]
attack-pattern--514dc7b3-0b80-4382-80a9-2e2d294f5019 - InstallUtil – text [applied]
attack-pattern--2cd950a6-16c4-404a-aa01-044322395107 - Timestomp – text [applied]
attack-pattern--47f2d673-ca62-47e9-929b-1b0be9657611 - Hijack Execution Flow – text [applied]
attack-pattern--aedfca76-3b30-4866-b2aa-0f1d7fd1e4b6 - SVG Smuggling – text [applied]
attack-pattern--78b9e70d-1605-459c-b23d-e3a25036968c - Indicator Removal from Tools – text [applied]
attack-pattern--b0533c6e-8fea-4788-874f-b799cacc4b92 - Scheduled Transfer – text [applied]
attack-pattern--4eeaf8a9-c86b-4954-a663-9555fb406466 - Exfiltration Over C2 Channel – text [applied]
attack-pattern--92d7da27-2d91-488e-a00c-059dc162766d - Exfiltration Over Symmetric Encrypted Non-C2 Protocol – text [applied]
attack-pattern--79a4052e-1a89-4b09-aea6-51f1d11fe19c - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol – text [applied]
attack-pattern--8e350c1d-ac79-4b5c-bd4e-7476d7e84ec5 - Data Transfer Size Limits – text [applied]
attack-pattern--c3888c54-775d-4b2f-b759-75a2ececcbfd - Exfiltration Over Physical Medium – text [applied]
attack-pattern--e6415f09-df0e-48de-9aba-928c902b7549 - Exfiltration over USB – text [applied]
attack-pattern--a3e1e6c5-9c74-4fc0-a16c-a9d228c17829 - Group Policy Discovery – text [applied]
attack-pattern--1b20efbf-8063-4fc3-a07d-b575318a301b - Password Policy Discovery – text [applied]
attack-pattern--b6075259-dba3-44e9-87c7-e954f37ec0d5 - Local Email Collection – text [applied]
attack-pattern--1e9eb839-294b-48cc-b0d3-c45555a2a004 - Remote Email Collection – text [applied]
attack-pattern--b4694861-542c-48ea-9eb1-10d356e7140a - Data from Network Shared Drive – text [applied]
attack-pattern--ae676644-d2d2-41b7-af7e-9bed1b55898c - Sharepoint – text [applied]
attack-pattern--0c4b4fda-9062-47da-98b9-ceae2dcf052a - Confluence – text [applied]
attack-pattern--7ad38ef1-381a-406d-872a-38b136eb5ecc - Artificial Intelligence – text [applied]
attack-pattern--0cc222f5-c3ff-48e6-9f52-3314baf9d37e - Malware – text [applied]
attack-pattern--7807d3a4-a885-4639-a786-c1ed41484970 - Develop Capabilities – text [applied]
attack-pattern--edadea33-549c-4ed1-9783-8f5a5853cbdf - Digital Certificates – text [applied]
attack-pattern--1cec9319-743b-4840-bb65-431547bce82a - Dead Drop Resolver – text [applied]
attack-pattern--f7827069-0bf2-4764-af4f-23fae0d181b7 - Symmetric Cryptography – text [applied]
attack-pattern--24bfaeba-cb0d-4525-b3dc-507c77ecec41 - Asymmetric Cryptography – text [applied]
attack-pattern--bf176076-b789-408e-8cba-7275e81c0ada - Compromise Software Dependencies and Development Tools – text [applied]
attack-pattern--191cc6af-1bb2-4344-ab5f-28e496638720 - Phishing – text [applied]
attack-pattern--a62a8db3-f23a-4d8f-afd6-9dbc77e7813b - Analytic 0466 – text [applied]
x-mitre-analytic--10d8886b-6cf6-45af-b187-04541e2ffaa4 - Analytic 0157 – text [applied]
x-mitre-analytic--9e0af3ac-dfeb-48c3-8d15-5f9edd69be69 - Analytic 0339 – text [applied]
x-mitre-analytic--af7bff30-45c5-4baf-9ced-68208b7ae836 - Analytic 0353 – text [applied]
x-mitre-analytic--e5b0d0ab-a464-4e9f-a1c0-dfb08a6ef53f - Group Modification – text [applied]
x-mitre-data-component--05d5b5b4-ef93-4807-b05f-33d8c5a35bc5 - Response Metadata – text [applied]
x-mitre-data-component--1067aa74-5796-4d9b-b4f1-a4c9eb6fd9da - Service Creation – text [applied]
x-mitre-data-component--5297a638-1382-4f0c-8472-0d21830bf705 - Container Start – text [applied]
x-mitre-data-component--5fe82895-28e5-4aac-845e-dc886b63be2e - Firewall Metadata – text [applied]
x-mitre-data-component--746f095a-f84c-4ccc-90a5-c7caa5c100a2 - Group Metadata – text [applied]
x-mitre-data-component--8d8c7cac-94cf-4726-8989-cab33851168c - Named Pipe Metadata – text [applied]
x-mitre-data-component--b9a1578e-8653-4103-be23-cb52e0b1816e - Firewall Rule Modification – text [applied]
x-mitre-data-component--d2ff4b56-8351-4ed8-b0fb-d8605366005f - Driver Metadata – text [applied]
x-mitre-data-component--f5a9a1dd-82f9-41a3-85b8-13e5b9cd6c79
New links (62)
- Blocks → attack-pattern--c5e8ef5d-e9b4-46b2-9dd8-afbb1c42090f [applied]
course-of-action--12241367-a8b7-49b4-b86e-2236901ba50c - Blocks → attack-pattern--d35b46b5-9be7-4a74-810b-2eabdd167fea [applied]
course-of-action--12241367-a8b7-49b4-b86e-2236901ba50c - Blocks → attack-pattern--d52e7766-3e2e-4500-8730-0bd1bb8f7eaf [applied]
course-of-action--12241367-a8b7-49b4-b86e-2236901ba50c - Blocks → attack-pattern--c5e8ef5d-e9b4-46b2-9dd8-afbb1c42090f [applied]
course-of-action--20f6a9df-37c4-4e20-9e47-025983b1b39d - Blocks → attack-pattern--d52e7766-3e2e-4500-8730-0bd1bb8f7eaf [applied]
course-of-action--20f6a9df-37c4-4e20-9e47-025983b1b39d - Blocks → attack-pattern--d35b46b5-9be7-4a74-810b-2eabdd167fea [applied]
course-of-action--20f6a9df-37c4-4e20-9e47-025983b1b39d - Blocks → attack-pattern--6c427a0d-e0df-41f8-b522-e59eaab44c47 [applied]
course-of-action--2a4f6c11-a4a7-4cb9-b0ef-6ae1bb3a718a - Blocks → attack-pattern--c0a6e9ec-9ef1-46b6-8a71-cc73863e8985 [applied]
course-of-action--2a4f6c11-a4a7-4cb9-b0ef-6ae1bb3a718a - Blocks → attack-pattern--d7e9cba9-3b43-4208-8e90-fdb18bff4a6a [applied]
course-of-action--2a4f6c11-a4a7-4cb9-b0ef-6ae1bb3a718a - Blocks → attack-pattern--2e45d340-f00b-4bd6-b5c9-c2ef54b8894c [applied]
course-of-action--2a4f6c11-a4a7-4cb9-b0ef-6ae1bb3a718a - Blocks → attack-pattern--6aa4bc38-0713-4d40-ad0b-949d912da852 [applied]
course-of-action--47e0e9fe-96ce-4f65-8bb1-8be1feacb5db - Blocks → attack-pattern--2e45d340-f00b-4bd6-b5c9-c2ef54b8894c [applied]
course-of-action--47e0e9fe-96ce-4f65-8bb1-8be1feacb5db - Blocks → attack-pattern--d7e9cba9-3b43-4208-8e90-fdb18bff4a6a [applied]
course-of-action--47e0e9fe-96ce-4f65-8bb1-8be1feacb5db - Blocks → attack-pattern--4484fb29-439d-4396-bbc3-4a7976710c1c [applied]
course-of-action--78bb71be-92b4-46de-acd6-5f998fedf1cc - Blocks → attack-pattern--2e45d340-f00b-4bd6-b5c9-c2ef54b8894c [applied]
course-of-action--86598de0-b347-4928-9eb0-0acbfc21908c - Blocks → attack-pattern--d7e9cba9-3b43-4208-8e90-fdb18bff4a6a [applied]
course-of-action--93e7968a-9074-4eac-8ae9-9f5200ec3317 - Blocks → attack-pattern--6c427a0d-e0df-41f8-b522-e59eaab44c47 [applied]
course-of-action--93e7968a-9074-4eac-8ae9-9f5200ec3317 - Blocks → attack-pattern--2e45d340-f00b-4bd6-b5c9-c2ef54b8894c [applied]
course-of-action--93e7968a-9074-4eac-8ae9-9f5200ec3317 - Blocks → attack-pattern--6aa4bc38-0713-4d40-ad0b-949d912da852 [applied]
course-of-action--93e7968a-9074-4eac-8ae9-9f5200ec3317 - Blocks → attack-pattern--2e45d340-f00b-4bd6-b5c9-c2ef54b8894c [applied]
course-of-action--987988f0-cf86-4680-a875-2f6456ab2448 - Blocks → attack-pattern--6aa4bc38-0713-4d40-ad0b-949d912da852 [applied]
course-of-action--987988f0-cf86-4680-a875-2f6456ab2448 - Blocks → attack-pattern--c0a6e9ec-9ef1-46b6-8a71-cc73863e8985 [applied]
course-of-action--987988f0-cf86-4680-a875-2f6456ab2448 - Blocks → attack-pattern--2e45d340-f00b-4bd6-b5c9-c2ef54b8894c [applied]
course-of-action--9bb9e696-bff8-4ae1-9454-961fc7d91d5f - Blocks → attack-pattern--d7e9cba9-3b43-4208-8e90-fdb18bff4a6a [applied]
course-of-action--9bb9e696-bff8-4ae1-9454-961fc7d91d5f - Blocks → attack-pattern--6aa4bc38-0713-4d40-ad0b-949d912da852 [applied]
course-of-action--9bb9e696-bff8-4ae1-9454-961fc7d91d5f - Blocks → attack-pattern--c0a6e9ec-9ef1-46b6-8a71-cc73863e8985 [applied]
course-of-action--b9f0c069-abbe-4a07-a245-2481219a1463 - Blocks → attack-pattern--6aa4bc38-0713-4d40-ad0b-949d912da852 [applied]
course-of-action--cc2399fd-3cd3-4319-8d0a-fbd6420cdaf8 - Blocks → attack-pattern--6c427a0d-e0df-41f8-b522-e59eaab44c47 [applied]
course-of-action--eb88d97c-32f1-40be-80f0-d61a4b0b4b31 - Blocks → attack-pattern--6c427a0d-e0df-41f8-b522-e59eaab44c47 [applied]
course-of-action--f9f9e6ef-bc0a-41ad-ba11-0924e5e84c4c - Relates → Techniques [applied]
attack-pattern--6c427a0d-e0df-41f8-b522-e59eaab44c47 - Relates → Techniques [applied]
attack-pattern--6aa4bc38-0713-4d40-ad0b-949d912da852 - Relates → Techniques [applied]
attack-pattern--2e45d340-f00b-4bd6-b5c9-c2ef54b8894c - Relates → Techniques [applied]
attack-pattern--d7e9cba9-3b43-4208-8e90-fdb18bff4a6a - Relates → Techniques [applied]
attack-pattern--c5e8ef5d-e9b4-46b2-9dd8-afbb1c42090f - Relates → Techniques [applied]
attack-pattern--d35b46b5-9be7-4a74-810b-2eabdd167fea - Relates → Techniques [applied]
attack-pattern--d52e7766-3e2e-4500-8730-0bd1bb8f7eaf - Relates → Techniques [applied]
attack-pattern--c0a6e9ec-9ef1-46b6-8a71-cc73863e8985 - Relates → Techniques [applied]
attack-pattern--4484fb29-439d-4396-bbc3-4a7976710c1c - Relates → Analytics [applied]
x-mitre-analytic--6522e464-d3f5-45dd-bfbf-2759f3fa6de2 - Relates → Analytics [applied]
x-mitre-analytic--8020317a-d34b-4330-a1a8-2787d8d69fc1 - Relates → Analytics [applied]
x-mitre-analytic--05e6aaf5-12c3-480a-9baa-0d7d64b2a94a - Relates → Detection Strategies [applied]
x-mitre-detection-strategy--93aad346-455d-4de1-ae61-b11fd5456263 - Blocks → attack-pattern--4484fb29-439d-4396-bbc3-4a7976710c1c [applied]
x-mitre-detection-strategy--93aad346-455d-4de1-ae61-b11fd5456263 - Relates → Analytics [applied]
x-mitre-analytic--22cc5f6f-76b9-477b-b44e-7fe8a9a3fddb - Relates → Analytics [applied]
x-mitre-analytic--34dd92d1-edc3-42db-9507-760d82c42a5f - Relates → Analytics [applied]
x-mitre-analytic--b06e4fe7-c1de-407b-82cb-c3b1ecef3b8b - Relates → Detection Strategies [applied]
x-mitre-detection-strategy--cbb2c861-8f0c-45ac-9005-4346e2ff6617 - Blocks → attack-pattern--6c427a0d-e0df-41f8-b522-e59eaab44c47 [applied]
x-mitre-detection-strategy--cbb2c861-8f0c-45ac-9005-4346e2ff6617 - Relates → Analytics [applied]
x-mitre-analytic--c3462a9e-35e2-4f7f-a132-d7379dd26eeb - Relates → Analytics [applied]
x-mitre-analytic--6db98b8e-a274-4ee2-8e10-cae17a4c855f - Relates → Detection Strategies [applied]
x-mitre-detection-strategy--b91d85aa-d207-407e-b3dd-3adc4ed8fab0 - Blocks → attack-pattern--d35b46b5-9be7-4a74-810b-2eabdd167fea [applied]
x-mitre-detection-strategy--b91d85aa-d207-407e-b3dd-3adc4ed8fab0 - Relates → Detection Strategies [applied]
x-mitre-detection-strategy--211b4197-345a-4776-8391-0c368eb534e2 - Blocks → attack-pattern--d52e7766-3e2e-4500-8730-0bd1bb8f7eaf [applied]
x-mitre-detection-strategy--211b4197-345a-4776-8391-0c368eb534e2 - Relates → Analytics [applied]
x-mitre-analytic--dde1f5e7-6aea-454c-9521-231257bb53c3 - Relates → Detection Strategies [applied]
x-mitre-detection-strategy--832681d0-1369-4915-a7b4-6627d7205a67 - Blocks → attack-pattern--c5e8ef5d-e9b4-46b2-9dd8-afbb1c42090f [applied]
x-mitre-detection-strategy--832681d0-1369-4915-a7b4-6627d7205a67 - Relates → Detection Strategies [applied]
x-mitre-detection-strategy--0567c079-3df3-404a-b69d-1690efd638b4 - Blocks → attack-pattern--c0a6e9ec-9ef1-46b6-8a71-cc73863e8985 [applied]
x-mitre-detection-strategy--0567c079-3df3-404a-b69d-1690efd638b4 - Relates → Analytics [applied]
x-mitre-analytic--d701cd5a-fa95-4c94-808b-ceb44120314d - Relates → Analytics [applied]
x-mitre-analytic--68906af9-7457-4285-9663-0d6ae7afccf4 - Relates → Analytics [applied]
x-mitre-analytic--5e07498b-9aba-41fa-bd95-212f9a9dc2fe
Свързани задачи
| Тип връзка | Задача |
|---|---|
| is related to | Enterprise ATT&CK |
| is related to | English |
| is related to | Major |
| is related to | New version |
| is related to | Information Security |
- MITREATTACK -
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. https://attack.mitre.org/
Terms of Use
LICENSE
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."
DISCLAIMERS
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by ATT&CK.
ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
See our FAQ for more information on how to use and represent the ATT&CK name.