DF/danfisher.devSystems / security / field notes
← Resources

Reference-data history

What changed?

Compare published MITRE ATT&CK® for ICS snapshots. Track edits and relationships without confusing a dataset release with the date a behavior first occurred.

From v19.2 (2026-08-05) → To v20.0 (2026-10-13). Added/removed mean present/absent relative to these snapshots, not newly invented/deleted behavior. Revoked and deprecated are retained source statuses. “Modified” includes metadata-only edits.

added9
modified83
revoked0
deprecated2
removed0

Counts above cover Techniques, before the Change type filter. 837 source objects changed across all types; 2173 objects in From and 2566 in To. Objects are matched by STIX ID and every top-level field is hashed independently. Formatting and JSON key order alone do not produce changes.

94 matching changes

v19.2 → v20.0 · page 1 of 2 · up to 50 objects per page
ObjectChangeSource fields changedVersions / status
T0800 · Activate Firmware Update Modeattack-pattern--19a71d1e-6334-4233-8260-b749cae37953Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0801 · Monitor Process Stateattack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364bTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0802 · Automated Collectionattack-pattern--3de230d4-3e42-4041-b089-17e1128fededTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux

views

From

ICS

To

ICS, Embedded, Windows, Linux

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0806 · Brute Force I/Oattack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux

views

From

ICS

To

ICS, Embedded, Windows, Linux

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0807 · Command-Line Interfaceattack-pattern--24a9253e-8948-4c98-b751-8e2aee53127cTechniques
Inspect 3 changed projected field(s)

assetIds

From

A0001, A0002, A0006, A0007, A0008, A0009, A0012, A0015, A0016

To

[empty list]

views

From

ICS

To

[empty list]

deprecated

From

false

To

true

deprecatedmodified, x_mitre_deprecated

From: 1.1 · source

To: 1.1 · deprecated · source

T0809 · Data Destructionattack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0811 · Data from Information Repositoriesattack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20fTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux

views

From

ICS

To

ICS, Embedded, Windows, Linux

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0814 · Denial of Serviceattack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5bTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0816 · Device Restart/Shutdownattack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0817 · Drive-by Compromiseattack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9aTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Windows, Linux

views

From

ICS

To

ICS, Windows, Linux

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0819 · Exploit Public-Facing Applicationattack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0820 · Exploitation for Evasionattack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0821 · Modify Controller Taskingattack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded

views

From

ICS

To

ICS, Embedded

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0822 · External Remote Servicesattack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215cTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0823 · Graphical User Interfaceattack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cfTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0830 · Adversary-in-the-Middleattack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3bTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 2.0 · source

To: 2.0 · source

T0834 · Native APIattack-pattern--b52870cc-83f3-473c-b895-72d91751030bTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0835 · Manipulate I/O Imageattack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded

views

From

ICS

To

ICS, Embedded

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0836 · Modify Parameterattack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux

views

From

ICS

To

ICS, Embedded, Windows, Linux

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.3 · source

To: 1.3 · source

T0838 · Modify Alarm Settingsattack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0840 · Network Connection Enumerationattack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566eTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0842 · Network Sniffingattack-pattern--38213338-1aab-479d-949b-c81b66ccca5cTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0843 · Program Downloadattack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded

views

From

ICS

To

ICS, Embedded

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0843.001 · Download Allattack-pattern--77015a55-eef8-4f71-a071-b152f82ec1efTechniques
Inspect 2 changed projected field(s)

platforms

From

[field absent]

To

Embedded

views

From

ICS

To

ICS, Embedded

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0843.002 · Online Editattack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83cTechniques
Inspect 2 changed projected field(s)

platforms

From

[field absent]

To

Embedded

views

From

ICS

To

ICS, Embedded

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0843.003 · Program Appendattack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135Techniques
Inspect 2 changed projected field(s)

platforms

From

[field absent]

To

Embedded

views

From

ICS

To

ICS, Embedded

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0845 · Program Uploadattack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded

views

From

ICS

To

ICS, Embedded

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0846 · Remote System Discoveryattack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0846.001 · Port Scanattack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7aTechniques
Inspect 2 changed projected field(s)

platforms

From

[field absent]

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0846.002 · Broadcast Discoveryattack-pattern--c55f0be5-044e-4577-8095-65b37680d28cTechniques
Inspect 2 changed projected field(s)

platforms

From

[field absent]

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0846.003 · Multicast Discoveryattack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91Techniques
Inspect 2 changed projected field(s)

platforms

From

[field absent]

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0847 · Replication Through Removable Mediaattack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0848 · Rogue Masterattack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bbTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0849 · Masqueradingattack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0851 · Rootkitattack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0852 · Screen Captureattack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux

views

From

ICS

To

ICS, Embedded, Windows, Linux

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0853 · Scriptingattack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958Techniques
Inspect 3 changed projected field(s)

assetIds

From

A0001, A0002, A0006, A0007, A0008, A0009, A0012, A0015, A0016

To

[empty list]

views

From

ICS

To

[empty list]

deprecated

From

false

To

true

deprecatedmodified, x_mitre_attack_spec_version, x_mitre_deprecated

From: 1.0 · source

To: 1.0 · deprecated · source

T0858 · Change Operating Modeattack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded

views

From

ICS

To

ICS, Embedded

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0859 · Valid Accountsattack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0860 · Wireless Compromiseattack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157eTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux

views

From

ICS

To

ICS, Embedded, Windows, Linux

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0861 · Point & Tag Identificationattack-pattern--25852363-5968-4673-b81d-341d5ed90bd1Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0862 · Supply Chain Compromiseattack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0863 · User Executionattack-pattern--2736b752-4ec5-4421-a230-8977dea7649cTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux

views

From

ICS

To

ICS, Embedded, Windows, Linux

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0864 · Transient Cyber Assetattack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Windows, Linux

views

From

ICS

To

ICS, Windows, Linux

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0865 · Spearphishing Attachmentattack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux

views

From

ICS

To

ICS, Embedded, Windows, Linux

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0866 · Exploitation of Remote Servicesattack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0eeTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0867 · Lateral Tool Transferattack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9dTechniques
Inspect 3 changed projected field(s)

description

From

Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation. (Citation: Enterprise ATT&CK) Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares. (Citation: Enterprise ATT&CK) In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks.

To

Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation.(Citation: Enterprise ATT&CK) Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares.(Citation: Enterprise ATT&CK) In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks.

platforms

From

None

To

Embedded, Windows, Linux

views

From

ICS

To

ICS, Embedded, Windows, Linux

modifieddescription, modified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0868 · Detect Operating Modeattack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847aTechniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded

views

From

ICS

To

ICS, Embedded

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0869 · Standard Application Layer Protocolattack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387Techniques
Inspect 2 changed projected field(s)

platforms

From

None

To

Embedded, Windows, Linux, Network Devices

views

From

ICS

To

ICS, Embedded, Windows, Linux, Network Devices

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0869.001 · DNSattack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64deTechniquesaddedcreated, created_by_ref, description, external_references, id, kill_chain_phases, modified, name, object_marking_refs, revoked, spec_version, type, x_mitre_attack_spec_version, x_mitre_deprecated, x_mitre_domains, x_mitre_is_subtechnique, x_mitre_modified_by_ref, x_mitre_version

From: absent

To: 1.0 · source

Derived technique/asset membership changes (85 techniques)

A relationship edit can change targeted assets or hierarchy without modifying the technique object itself. These computed differences are separate from the source-object counts above. Website-rule membership in older releases may be reconstructed, not observed.

T0800 · Activate Firmware Update Mode

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0801 · Monitor Process State

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0802 · Automated Collection

views: ICS → ICS, Embedded, Windows, Linux

T0806 · Brute Force I/O

views: ICS → ICS, Embedded, Windows, Linux

T0807 · Command-Line Interface

assetIds: A0001, A0002, A0006, A0007, A0008, A0009, A0012, A0015, A0016 → [empty list]

views: ICS → [empty list]

T0809 · Data Destruction

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0811 · Data from Information Repositories

views: ICS → ICS, Embedded, Windows, Linux

T0814 · Denial of Service

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0816 · Device Restart/Shutdown

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0817 · Drive-by Compromise

views: ICS → ICS, Windows, Linux

T0819 · Exploit Public-Facing Application

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0820 · Exploitation for Evasion

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0821 · Modify Controller Tasking

views: ICS → ICS, Embedded

T0822 · External Remote Services

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0823 · Graphical User Interface

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0830 · Adversary-in-the-Middle

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0834 · Native API

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0835 · Manipulate I/O Image

views: ICS → ICS, Embedded

T0836 · Modify Parameter

views: ICS → ICS, Embedded, Windows, Linux

T0838 · Modify Alarm Settings

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0840 · Network Connection Enumeration

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0842 · Network Sniffing

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0843 · Program Download

views: ICS → ICS, Embedded

T0843.001 · Download All

views: ICS → ICS, Embedded

T0843.002 · Online Edit

views: ICS → ICS, Embedded

T0843.003 · Program Append

views: ICS → ICS, Embedded

T0845 · Program Upload

views: ICS → ICS, Embedded

T0846 · Remote System Discovery

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0846.001 · Port Scan

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0846.002 · Broadcast Discovery

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0846.003 · Multicast Discovery

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0847 · Replication Through Removable Media

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0848 · Rogue Master

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0849 · Masquerading

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0851 · Rootkit

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0852 · Screen Capture

views: ICS → ICS, Embedded, Windows, Linux

T0853 · Scripting

assetIds: A0001, A0002, A0006, A0007, A0008, A0009, A0012, A0015, A0016 → [empty list]

views: ICS → [empty list]

T0858 · Change Operating Mode

views: ICS → ICS, Embedded

T0859 · Valid Accounts

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0860 · Wireless Compromise

views: ICS → ICS, Embedded, Windows, Linux

T0861 · Point & Tag Identification

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0862 · Supply Chain Compromise

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0863 · User Execution

views: ICS → ICS, Embedded, Windows, Linux

T0864 · Transient Cyber Asset

views: ICS → ICS, Windows, Linux

T0865 · Spearphishing Attachment

views: ICS → ICS, Embedded, Windows, Linux

T0866 · Exploitation of Remote Services

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0867 · Lateral Tool Transfer

views: ICS → ICS, Embedded, Windows, Linux

T0868 · Detect Operating Mode

views: ICS → ICS, Embedded

T0869 · Standard Application Layer Protocol

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0871 · Execution through API

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0872 · Indicator Removal on Host

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0873 · Project File Infection

views: ICS → ICS, Windows, Linux

T0873.001 · Siemens Project File Format

views: ICS → ICS, Windows, Linux

T0874 · Hooking

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0877 · I/O Image

views: ICS → ICS, Embedded

T0878 · Alarm Suppression

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0881 · Service Stop

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0883 · Internet Accessible Device

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0884 · Connection Proxy

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0885 · Commonly Used Port

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0886 · Remote Services

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0887 · Wireless Sniffing

views: ICS → ICS, Embedded, Windows, Linux

T0888 · Remote System Information Discovery

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0889 · Modify Program

views: ICS → ICS, Embedded

T0890 · Exploitation for Privilege Escalation

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0892 · Change Credential

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0893 · Data from Local System

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T0894 · System Binary Proxy Execution

views: ICS → ICS, Embedded, Windows, Linux

T0895 · Autorun Image

views: ICS → ICS, Embedded, Windows, Linux

T1691 · Block Operational Technology Message

views: ICS → ICS, Embedded, Windows, Linux

T1691.001 · Command Message

views: ICS → ICS, Embedded, Windows, Linux

T1691.002 · Reporting Message

views: ICS → ICS, Embedded, Windows, Linux

T1692 · Unauthorized Message

views: ICS → ICS, Embedded, Windows, Linux

T1692.001 · Command Message

views: ICS → ICS, Embedded, Windows, Linux

T1692.002 · Reporting Message

views: ICS → ICS, Embedded, Windows, Linux

T1693 · Modify Firmware

views: ICS → ICS, Embedded

T1693.001 · System Firmware

views: ICS → ICS, Embedded

T1693.002 · Module Firmware

views: ICS → ICS, Embedded

T1694 · Insecure Credentials

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T1694.001 · Default Credentials

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T1694.002 · Hardcoded Credentials

views: ICS → ICS, Embedded

T1695 · Block Communications

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T1695.001 · Serial COM

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T1695.002 · Ethernet

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

T1695.003 · Wi-Fi

views: ICS → ICS, Embedded, Windows, Linux, Network Devices

Release snapshots, not process historization.

These comparisons reconstruct published releases, not every intermediate edit. They are suitable for citing an assessment baseline or reviewing knowledge-base changes—not for proving when attackers first used a technique, when a vulnerability appeared, or when a site became exposed.

For original values in fields outside the projected technique detail, download each release’s From source ZIP and To source ZIP. All revoked/deprecated objects and relationships are preserved.

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Independent presentation and labeled interpretation by Dan Fisher; not affiliated with or endorsed by MITRE or Emerson. Source content retains MITRE’s license and disclaimers, not the site’s CC BY teaching-material license.

No installed asset, control, or detection has been assessed. No connection to the private lab; no scanning or live-system testing is authorized.