New version: MITRE ATT&CK ICS (20.0) – 0 new, 112 changed, 0 removed
- Document: MITRE ATT&CK ICS (https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/ics-attack/ics-attack-20.0.json)
- Version: 20.0
- Project: MITREATTACK
- Import: #614, 20.10.2026 17:06, mitre
The new version was compared with the existing issues. Changes are only applied once approved in the administration (Importer › Proposed changes).
Taken over directly (additional fields, HTML of an unchanged text): 398 issues.
Review: 0 open, 112 applied, 0 rejected.
Changed sections (112)
- Filter Network Traffic – text [applied]
course-of-action--11f242bc-3121-438c-84b2-5cbd46a4bb17 - Validate Program Inputs – text [applied]
course-of-action--1cbcceef-3233-4062-aa86-ec91afe39517 - Network Segmentation – text [applied]
course-of-action--1e7ccfc0-94c8-496e-8d27-032120892291 - Access Management – text [applied]
course-of-action--3992ce42-43e9-4bea-b8db-a102ec3ec1e3 - Human User Authentication – text [applied]
course-of-action--66cfe23e-34b6-4583-b178-ed6a412db2b0 - Mechanical Protection Layers – text [applied]
course-of-action--8bc4a54e-810c-4600-8b6c-08fa8413a401 - Network Allowlists – text [applied]
course-of-action--aadac250-bcdc-44e3-a4ae-f52bd0a7a16a - Data Backup – text [applied]
course-of-action--ad12819e-3211-4291-b360-069f280cff0a - Out-of-Band Communications Channel – text [applied]
course-of-action--b11cad63-ef30-4eb8-af0d-6cc46eef3f3e - Safety Instrumented Systems – text [applied]
course-of-action--da44255d-85c5-492c-baf3-ee823d44f848 - Authorization Enforcement – text [applied]
course-of-action--e0d38502-decb-481d-ad8b-b8f0a0c330bd - Antivirus/Antimalware – text [applied]
course-of-action--faf2b40e-5981-433f-aa46-17458e0026f7 - Minimize Wireless Signal Propagation – text [applied]
course-of-action--fce6866f-9a87-4d3e-a73c-f02d8937fe0e - Field I/O – text [applied]
x-mitre-asset--2b676abd-8263-49ea-81a4-78a7e1f776fe - Data Gateway – text [applied]
x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4 - Programmable Logic Controller (PLC) – text [applied]
x-mitre-asset--986c455b-0f43-42b6-8360-33ac48bd9990 - Routers – text [applied]
x-mitre-asset--dcb1d1c1-b195-45bf-b4cf-5b98c5b859a5 - Inhibit Response Function – text [applied]
x-mitre-tactic--298fe907-7931-4fd2-8131-2814dd493134 - Service Stop – text [applied]
attack-pattern--063b5b92-5361-481a-9c3f-95492ed9a2d8 - Denial of Service – text [applied]
attack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5b - Alarm Suppression – text [applied]
attack-pattern--2900bbd8-308a-4274-b074-5b8bde8347bc - Block Operational Technology Message – text [applied]
attack-pattern--338f4364-2269-4f70-9079-b20384b16628 - Command Message – text [applied]
attack-pattern--15ca2a99-2d3e-457f-b1d7-c52a1d5849c9 - Reporting Message – text [applied]
attack-pattern--7866bb5f-98ee-45c2-984c-8a328c5176b2 - Manipulate I/O Image – text [applied]
attack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004 - Data Destruction – text [applied]
attack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675 - Modify Alarm Settings – text [applied]
attack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92 - Change Credential – text [applied]
attack-pattern--fab8fc7d-f27f-4fbb-9de6-44740aade05f - Block Communications – text [applied]
attack-pattern--fbb67c2d-37c3-49ee-86e3-bf234cc48ca9 - Ethernet – text [applied]
attack-pattern--6008c1f0-1b68-4614-8f5b-a547436b8855 - Wi-Fi – text [applied]
attack-pattern--71f2d49e-65dd-4fb6-a4cc-0d2b19d427fa - Exploitation for Privilege Escalation – text [applied]
attack-pattern--cfe68e93-ce94-4c0f-a57d-3aa72cedd618 - Lateral Movement – text [applied]
x-mitre-tactic--51c25a9e-8615-40c0-8afd-1da578847924 - Program Organization Units – text [applied]
attack-pattern--ae62fe1a-ea1a-479b-8dc0-65d250bd8bc7 - Program Download – text [applied]
attack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068 - Lateral Tool Transfer – text [applied]
attack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9d - Wireless Sniffing – text [applied]
attack-pattern--0fe075d5-beac-4d02-b93e-0f874997db72 - Network Sniffing – text [applied]
attack-pattern--38213338-1aab-479d-949b-c81b66ccca5c - Remote System Discovery – text [applied]
attack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061 - Port Scan – text [applied]
attack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7a - Multicast Discovery – text [applied]
attack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91 - Broadcast Discovery – text [applied]
attack-pattern--c55f0be5-044e-4577-8095-65b37680d28c - Network Connection Enumeration – text [applied]
attack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566e - Wireless Compromise – text [applied]
attack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157e - Transient Cyber Asset – text [applied]
attack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9 - Data Historian Compromise – text [applied]
attack-pattern--50d3222f-7550-4a3c-94e1-78cb6c81d064 - Supply Chain Compromise – text [applied]
attack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3 - Spearphishing Attachment – text [applied]
attack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426 - Drive-by Compromise – text [applied]
attack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9a - Exploitation of Remote Services – text [applied]
attack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0ee - External Remote Services – text [applied]
attack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215c - Rogue Master – text [applied]
attack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bb - Replication Through Removable Media – text [applied]
attack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21 - Remote Services – text [applied]
attack-pattern--e1f9cdd2-9511-4fca-90d7-f3e92cfdd0bf - Internet Accessible Device – text [applied]
attack-pattern--f8df6b57-14bc-425f-9a91-6f59f6799307 - Impact – text [applied]
x-mitre-tactic--77542f83-70d0-40c2-8a9d-ad2eb8b00279 - Loss of View – text [applied]
attack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36 - Manipulation of Control – text [applied]
attack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1 - Manipulation of View – text [applied]
attack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ec - Denial of View – text [applied]
attack-pattern--56ddc820-6cfb-407f-850b-52c035d123ac - Loss of Productivity and Revenue – text [applied]
attack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120ee - Damage to Property – text [applied]
attack-pattern--83ebd22f-b401-4d59-8219-2294172cf916 - Loss of Control – text [applied]
attack-pattern--a81696ef-c106-482c-8f80-59c30f2569fb - Loss of Availability – text [applied]
attack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95 - Theft of Operational Information – text [applied]
attack-pattern--b7e13ee8-182c-4f19-92a4-a88d7d855d54 - Denial of Control – text [applied]
attack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20 - Insecure Credentials – text [applied]
attack-pattern--3e9b182e-e493-49e1-9a9b-bd0dfcd34a7c - Default Credentials – text [applied]
attack-pattern--5658ad88-7510-490e-a351-95d50b1bcd91 - Hardcoded Credentials – text [applied]
attack-pattern--6b335943-c3af-430e-a135-ab09623bdc20 - Modify Firmware – text [applied]
attack-pattern--7b4c0e19-a9b0-4a74-a196-b38c07b79f20 - System Firmware – text [applied]
attack-pattern--68a9324d-a524-4766-a899-a026f68a33df - Module Firmware – text [applied]
attack-pattern--75587e49-ab7e-44df-9549-faeb1da57f39 - Valid Accounts – text [applied]
attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101 - Project File Infection – text [applied]
attack-pattern--e72425f8-9ae6-41d3-bfdb-e1b865e60722 - Siemens Project File Format – text [applied]
attack-pattern--354ca909-b54d-4c41-b597-9c296b344a43 - Modify Program – text [applied]
attack-pattern--fc5fda7e-6b2c-4457-b036-759896a2efa2 - Execution – text [applied]
x-mitre-tactic--93bf9a8e-b14c-4587-b6d5-9efc7c12eb45 - Modify Controller Tasking – text [applied]
attack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243 - Command-Line Interface – text [applied]
attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c - User Execution – text [applied]
attack-pattern--2736b752-4ec5-4421-a230-8977dea7649c - Change Operating Mode – text [applied]
attack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601 - Hooking – text [applied]
attack-pattern--ab390887-afc0-4715-826d-b1b167d522ae - Native API – text [applied]
attack-pattern--b52870cc-83f3-473c-b895-72d91751030b - Command and Scripting Interpreter – text [applied]
attack-pattern--abc2529d-70c0-4971-b25f-0dce8cffb427 - Unix Shell – text [applied]
attack-pattern--26659f1a-7557-4833-a42e-b6dba9104f4a - JavaScript – text [applied]
attack-pattern--09c897b1-2ce6-4187-8548-bda1cb18d5a2 - Python – text [applied]
attack-pattern--2cbed5e4-65e3-40bf-a376-82c7a23e3665 - PowerShell – text [applied]
attack-pattern--e3496d05-0826-4187-a993-80f29aa5a40a - Windows Command Shell – text [applied]
attack-pattern--84acafb8-775e-4381-a156-876fd7ea129e - Visual Basic – text [applied]
attack-pattern--d0225461-2610-469e-8c52-56ec12ac0c71 - Connection Proxy – text [applied]
attack-pattern--d67adac8-e3b9-44f9-9e6d-6c2a7d69dbe4 - DNS – text [applied]
attack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64de - Commonly Used Port – text [applied]
attack-pattern--e6c31185-8040-4267-83d3-b217b8a92f07 - Collection – text [applied]
x-mitre-tactic--b2a67b1e-913c-46f6-b219-048a90560bb9 - Point & Tag Identification – text [applied]
attack-pattern--25852363-5968-4673-b81d-341d5ed90bd1 - Detect Operating Mode – text [applied]
attack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847a - Data from Information Repositories – text [applied]
attack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20f - I/O Image – text [applied]
attack-pattern--53a48c74-0025-45f4-b04a-baa853df8204 - Location Identification – text [applied]
attack-pattern--7374ab87-0782-41f8-b415-678c0950bb2a - Adversary-in-the-Middle – text [applied]
attack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3b - Screen Capture – text [applied]
attack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377 - Data from Local System – text [applied]
attack-pattern--fa3aa267-da22-4bdd-961f-03223322a8d5 - System Binary Proxy Execution – text [applied]
attack-pattern--1c5cf58c-a34a-40d7-82f4-f987cdfc2b91 - Rootkit – text [applied]
attack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9 - Exploitation for Evasion – text [applied]
attack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03 - Unauthorized Message – text [applied]
attack-pattern--e17cdc00-8b58-4e5f-9d50-4cad1592c4c3 - Command Message – text [applied]
attack-pattern--4344d1b8-968b-4697-9ab9-f9abe5f52265 - Reporting Message – text [applied]
attack-pattern--527106b3-95a2-4ed2-bf89-db7f0e4d0da0 - Impair Process Control – text [applied]
x-mitre-tactic--ff048b6c-b872-4218-b68c-3735ebd1f024 - Modify Parameter – text [applied]
attack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722 - Modify Control Logic – text [applied]
attack-pattern--e0d74479-86d2-465d-bf36-903ebecef43e - Analytic 2119 – text [applied]
x-mitre-analytic--792af2a0-7fc2-4b63-899e-ae09dea3aef1
Links the source no longer names (they stay): 25
- course-of-action--059ba11e-e3dc-49aa-84ca-88197f40d4ea → Blocks MITREATTACK attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958
- course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30 → Blocks MITREATTACK attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c
- course-of-action--4fa717d9-cabe-47c8-8cdd-86e9e2e37f30 → Blocks MITREATTACK attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958
- course-of-action--d0909119-2f71-4923-87db-b649881672d7 → Blocks MITREATTACK attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c
- course-of-action--d0909119-2f71-4923-87db-b649881672d7 → Blocks MITREATTACK attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958
- attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c → Relates MITREATTACK x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3
- attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c → Relates MITREATTACK x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d
- attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c → Relates MITREATTACK x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41
- attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c → Relates MITREATTACK x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4
- attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c → Relates MITREATTACK x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64
- attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c → Relates MITREATTACK x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237
- attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c → Relates MITREATTACK x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95
- attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c → Relates MITREATTACK x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499
- attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c → Relates MITREATTACK x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787
- attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958 → Relates MITREATTACK x-mitre-asset--ecb81a8b-022e-4529-a404-55cffca7d3a3
- attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958 → Relates MITREATTACK x-mitre-asset--973bc51e-c41e-4cec-ac03-9389c71f3d0d
- attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958 → Relates MITREATTACK x-mitre-asset--f1315d02-9118-4e3b-8cdf-4c2d3f77ce41
- attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958 → Relates MITREATTACK x-mitre-asset--68388d4f-8138-420b-be2b-5a7dfe9ff6b4
- attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958 → Relates MITREATTACK x-mitre-asset--3a95f7e4-4877-4967-b2e8-e287976c3e64
- attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958 → Relates MITREATTACK x-mitre-asset--bb141168-ae41-4974-8ece-dc9b63e59237
- attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958 → Relates MITREATTACK x-mitre-asset--bb553fda-8355-40bc-87c6-5ae25124fa95
- attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958 → Relates MITREATTACK x-mitre-asset--e2c3336a-dd93-44d6-8246-f93cf132c499
- attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958 → Relates MITREATTACK x-mitre-asset--14932ed5-1098-4cc1-9f57-159ab7366787
- x-mitre-detection-strategy--f9ea25e7-6e63-4ef1-a8ad-47a4a261e175 → Blocks MITREATTACK attack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958
- x-mitre-detection-strategy--c0abb110-c80e-4d6a-9f27-f2783f8bbfec → Blocks MITREATTACK attack-pattern--24a9253e-8948-4c98-b751-8e2aee53127c
Kwistjonijiet marbuta
| Tip ta’ link | Kwistjoni |
|---|---|
| is related to | ICS ATT&CK |
| is related to | English |
| is related to | Major |
| is related to | New version |
| is related to | Information Security |
- MITREATTACK -
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. https://attack.mitre.org/
Terms of Use
LICENSE
The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
"© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation."
DISCLAIMERS
MITRE does not claim ATT&CK enumerates all possibilities for the types of actions and behaviors documented as part of its adversary model and framework of techniques. Using the information contained within ATT&CK to address or cover full categories of techniques will not guarantee full defensive coverage as there may be undisclosed techniques or variations on existing techniques not documented by ATT&CK.
ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
See our FAQ for more information on how to use and represent the ATT&CK name.