Reference-data history

What changed?

Compare published MITRE ATT&CK® for ICS snapshots. Track edits and relationships without confusing a dataset release with the date a behavior first occurred.

From v20.0 (2026-10-13) → To v18.1 (2025-11-13). Added/removed mean present/absent relative to these snapshots, not newly invented/deleted behavior. Revoked and deprecated are retained source statuses. “Modified” includes metadata-only edits.

added0

modified95

revoked0

deprecated0

removed32

Counts above cover Techniques, before the Change type filter. 2669 source objects changed across all types; 2566 objects in From and 1826 in To. Objects are matched by STIX ID and every top-level field is hashed independently. Formatting and JSON key order alone do not produce changes.

127 matching changes

v20.0 → v18.1 · page 1 of 3 · up to 50 objects per page
Object	Change	Source fields changed	Versions / status
T0800 · Activate Firmware Update Modeattack-pattern--19a71d1e-6334-4233-8260-b749cae37953Techniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.0 · source To: 1.0 · source
T0801 · Monitor Process Stateattack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364bTechniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.0 · source To: 1.0 · source
T0802 · Automated Collectionattack-pattern--3de230d4-3e42-4041-b089-17e1128fededTechniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux To None views From ICS, Embedded, Windows, Linux To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.1 · source To: 1.1 · source
T0803 · Block Command Messageattack-pattern--008b8f56-6107-48be-aa9f-746f927dbb61Techniques Inspect 3 changed projected field(s) assetIds From [empty list] To A0002, A0003, A0004, A0005, A0007, A0010, A0013, A0017, A0018 views From [empty list] To ICS revoked From true To false	modified	modified, revoked, x_mitre_detection	From: 1.1 · revoked · source To: 1.1 · source
T0804 · Block Reporting Messageattack-pattern--3f1f4ccb-9be2-4ff8-8f69-dd972221169bTechniques Inspect 3 changed projected field(s) assetIds From [empty list] To A0002, A0003, A0004, A0005, A0007, A0009, A0010, A0013, A0017, A0018 views From [empty list] To ICS revoked From true To false	modified	modified, revoked, x_mitre_detection	From: 1.0 · revoked · source To: 1.0 · source
T0805 · Block Serial COMattack-pattern--1c478716-71d9-46a4-9a53-fa5d576adb60Techniques Inspect 3 changed projected field(s) assetIds From [empty list] To A0001, A0002, A0003, A0004, A0005, A0007, A0009, A0010, A0011, A0012, A0013, A0017, A0018 views From [empty list] To ICS revoked From true To false	modified	modified, revoked, x_mitre_detection	From: 1.1 · revoked · source To: 1.1 · source
T0806 · Brute Force I/Oattack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4Techniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux To None views From ICS, Embedded, Windows, Linux To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.1 · source To: 1.1 · source
T0807 · Command-Line Interfaceattack-pattern--24a9253e-8948-4c98-b751-8e2aee53127cTechniques Inspect 3 changed projected field(s) assetIds From [empty list] To A0001, A0002, A0006, A0007, A0008, A0009, A0012, A0015, A0016 views From [empty list] To ICS deprecated From true To false	modified	modified, x_mitre_attack_spec_version, x_mitre_deprecated, x_mitre_detection	From: 1.1 · deprecated · source To: 1.1 · source
T0808 · Control Device Identificationattack-pattern--abb0a255-eb9c-48d0-8f5c-874bb84c0e45Techniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · deprecated · source To: 1.0 · deprecated · source
T0809 · Data Destructionattack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675Techniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.0 · source To: 1.0 · source
T0810 · Data Historian Compromiseattack-pattern--50d3222f-7550-4a3c-94e1-78cb6c81d064Techniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · deprecated · source To: 1.0 · deprecated · source
T0811 · Data from Information Repositoriesattack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20fTechniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux To None views From ICS, Embedded, Windows, Linux To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.2 · source To: 1.2 · source
T0812 · Default Credentialsattack-pattern--8bb4538f-f16f-49f0-a431-70b5444c7349Techniques Inspect 3 changed projected field(s) assetIds From [empty list] To A0001, A0002, A0003, A0004, A0005, A0006, A0007, A0008, A0009, A0010, A0011, A0012, A0013, A0014, A0015, A0016, A0017, A0018 views From [empty list] To ICS revoked From true To false	modified	modified, revoked, x_mitre_detection	From: 1.0 · revoked · source To: 1.0 · source
T0813 · Denial of Controlattack-pattern--e33c7ecc-5a38-497f-beb2-a9a2049a4c20Techniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.1 · source To: 1.1 · source
T0814 · Denial of Serviceattack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5bTechniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.1 · source To: 1.1 · source
T0815 · Denial of Viewattack-pattern--56ddc820-6cfb-407f-850b-52c035d123acTechniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.1 · source To: 1.1 · source
T0816 · Device Restart/Shutdownattack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9Techniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.1 · source To: 1.1 · source
T0817 · Drive-by Compromiseattack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9aTechniques Inspect 2 changed projected field(s) platforms From Windows, Linux To None views From ICS, Windows, Linux To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.0 · source To: 1.0 · source
T0818 · Engineering Workstation Compromiseattack-pattern--d614a9cf-18eb-4800-81e4-ab8ddf0baa73Techniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · deprecated · source To: 1.0 · deprecated · source
T0819 · Exploit Public-Facing Applicationattack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00Techniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.0 · source To: 1.0 · source
T0820 · Exploitation for Evasionattack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03Techniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.1 · source To: 1.1 · source
T0821 · Modify Controller Taskingattack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243Techniques Inspect 2 changed projected field(s) platforms From Embedded To None views From ICS, Embedded To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.2 · source To: 1.2 · source
T0822 · External Remote Servicesattack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215cTechniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.1 · source To: 1.1 · source
T0823 · Graphical User Interfaceattack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cfTechniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.1 · source To: 1.1 · source
T0824 · I/O Module Discoveryattack-pattern--e2994b6a-122b-4043-b654-7411c5198ec0Techniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · deprecated · source To: 1.0 · deprecated · source
T0825 · Location Identificationattack-pattern--7374ab87-0782-41f8-b415-678c0950bb2aTechniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · deprecated · source To: 1.0 · deprecated · source
T0826 · Loss of Availabilityattack-pattern--b5b9bacb-97f2-4249-b804-47fd44de1f95Techniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · source To: 1.0 · source
T0827 · Loss of Controlattack-pattern--a81696ef-c106-482c-8f80-59c30f2569fbTechniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	modified, x_mitre_attack_spec_version, x_mitre_detection	From: 1.0 · source To: 1.0 · source
T0828 · Loss of Productivity and Revenueattack-pattern--63b6942d-8359-4506-bfb3-cf87aa8120eeTechniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · source To: 1.0 · source
T0829 · Loss of Viewattack-pattern--138979ba-0430-4de6-a128-2fc0b056ba36Techniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	modified, x_mitre_attack_spec_version, x_mitre_detection	From: 1.0 · source To: 1.0 · source
T0830 · Adversary-in-the-Middleattack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3bTechniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 2.0 · source To: 2.0 · source
T0831 · Manipulation of Controlattack-pattern--1af9e3fd-2bcc-414d-adbd-fe3b95c02ca1Techniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · source To: 1.0 · source
T0832 · Manipulation of Viewattack-pattern--4c2e1408-9d68-4187-8e6b-a77bc52700ecTechniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · source To: 1.0 · source
T0833 · Modify Control Logicattack-pattern--e0d74479-86d2-465d-bf36-903ebecef43eTechniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · deprecated · source To: 1.0 · deprecated · source
T0834 · Native APIattack-pattern--b52870cc-83f3-473c-b895-72d91751030bTechniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.0 · source To: 1.0 · source
T0835 · Manipulate I/O Imageattack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004Techniques Inspect 2 changed projected field(s) platforms From Embedded To None views From ICS, Embedded To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.1 · source To: 1.1 · source
T0836 · Modify Parameterattack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722Techniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux To None views From ICS, Embedded, Windows, Linux To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.3 · source To: 1.3 · source
T0837 · Loss of Protectionattack-pattern--2bb4d762-bf4a-4bc3-9318-15cc6a354163Techniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · source To: 1.0 · source
T0838 · Modify Alarm Settingsattack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92Techniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.2 · source To: 1.2 · source
T0839 · Module Firmwareattack-pattern--efbf7888-f61b-4572-9c80-7e2965c60707Techniques Inspect 3 changed projected field(s) assetIds From [empty list] To A0003, A0010, A0017, A0018 views From [empty list] To ICS revoked From true To false	modified	modified, revoked, x_mitre_detection	From: 1.1 · revoked · source To: 1.1 · source
T0840 · Network Connection Enumerationattack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566eTechniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.2 · source To: 1.2 · source
T0841 · Network Service Scanningattack-pattern--539d0484-fe95-485a-b654-86991c0d0d00Techniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · deprecated · source To: 1.0 · deprecated · source
T0842 · Network Sniffingattack-pattern--38213338-1aab-479d-949b-c81b66ccca5cTechniques Inspect 2 changed projected field(s) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.0 · source To: 1.0 · source
T0843 · Program Downloadattack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068Techniques Inspect 2 changed projected field(s) platforms From Embedded To None views From ICS, Embedded To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.1 · source To: 1.1 · source
T0843.001 · Download Allattack-pattern--77015a55-eef8-4f71-a071-b152f82ec1efTechniques	removed	created, created_by_ref, description, external_references, id, kill_chain_phases, modified, name, object_marking_refs, revoked, spec_version, type, x_mitre_attack_spec_version, x_mitre_deprecated, x_mitre_domains, x_mitre_is_subtechnique, x_mitre_modified_by_ref, x_mitre_platforms, x_mitre_version	From: 1.0 · source To: absent
T0843.002 · Online Editattack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83cTechniques	removed	created, created_by_ref, description, external_references, id, kill_chain_phases, modified, name, object_marking_refs, revoked, spec_version, type, x_mitre_attack_spec_version, x_mitre_deprecated, x_mitre_domains, x_mitre_is_subtechnique, x_mitre_modified_by_ref, x_mitre_platforms, x_mitre_version	From: 1.0 · source To: absent
T0843.003 · Program Appendattack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135Techniques	removed	created, created_by_ref, description, external_references, id, kill_chain_phases, modified, name, object_marking_refs, revoked, spec_version, type, x_mitre_attack_spec_version, x_mitre_deprecated, x_mitre_domains, x_mitre_is_subtechnique, x_mitre_modified_by_ref, x_mitre_platforms, x_mitre_version	From: 1.0 · source To: absent
T0844 · Program Organization Unitsattack-pattern--ae62fe1a-ea1a-479b-8dc0-65d250bd8bc7Techniques No change to the displayed definition, tags, status, or derived memberships; other source fields changed.	modified	x_mitre_detection	From: 1.0 · deprecated · source To: 1.0 · deprecated · source
T0845 · Program Uploadattack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3Techniques Inspect 2 changed projected field(s) platforms From Embedded To None views From ICS, Embedded To ICS	modified	modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.0 · source To: 1.0 · source
T0846 · Remote System Discoveryattack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061Techniques Inspect 3 changed projected field(s) description From Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for subsequent Lateral Movement or Discovery techniques. Functionality could exist within adversary tools to enable this, but utilities available on the operating system or vendor software could also be used.(Citation: Enterprise ATT&CK January 2018) To Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for subsequent Lateral Movement or Discovery techniques. Functionality could exist within adversary tools to enable this, but utilities available on the operating system or vendor software could also be used. (Citation: Enterprise ATT&CK January 2018) platforms From Embedded, Windows, Linux, Network Devices To None views From ICS, Embedded, Windows, Linux, Network Devices To ICS	modified	description, modified, x_mitre_attack_spec_version, x_mitre_detection, x_mitre_platforms	From: 1.1 · source To: 1.1 · source

Derived technique/asset membership changes (71 techniques)

A relationship edit can change targeted assets or hierarchy without modifying the technique object itself. These computed differences are separate from the source-object counts above. Website-rule membership in older releases may be reconstructed, not observed.

T0800 · Activate Firmware Update Mode

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0801 · Monitor Process State

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0802 · Automated Collection

views: ICS, Embedded, Windows, Linux → ICS

T0803 · Block Command Message

assetIds: [empty list] → A0002, A0003, A0004, A0005, A0007, A0010, A0013, A0017, A0018

views: [empty list] → ICS

T0804 · Block Reporting Message

assetIds: [empty list] → A0002, A0003, A0004, A0005, A0007, A0009, A0010, A0013, A0017, A0018

views: [empty list] → ICS

T0805 · Block Serial COM

assetIds: [empty list] → A0001, A0002, A0003, A0004, A0005, A0007, A0009, A0010, A0011, A0012, A0013, A0017, A0018

views: [empty list] → ICS

T0806 · Brute Force I/O

views: ICS, Embedded, Windows, Linux → ICS

T0807 · Command-Line Interface

assetIds: [empty list] → A0001, A0002, A0006, A0007, A0008, A0009, A0012, A0015, A0016

views: [empty list] → ICS

T0809 · Data Destruction

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0811 · Data from Information Repositories

views: ICS, Embedded, Windows, Linux → ICS

T0812 · Default Credentials

assetIds: [empty list] → A0001, A0002, A0003, A0004, A0005, A0006, A0007, A0008, A0009, A0010, A0011, A0012, A0013, A0014, A0015, A0016, A0017, A0018

views: [empty list] → ICS

T0814 · Denial of Service

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0816 · Device Restart/Shutdown

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0817 · Drive-by Compromise

views: ICS, Windows, Linux → ICS

T0819 · Exploit Public-Facing Application

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0820 · Exploitation for Evasion

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0821 · Modify Controller Tasking

views: ICS, Embedded → ICS

T0822 · External Remote Services

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0823 · Graphical User Interface

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0830 · Adversary-in-the-Middle

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0834 · Native API

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0835 · Manipulate I/O Image

views: ICS, Embedded → ICS

T0836 · Modify Parameter

views: ICS, Embedded, Windows, Linux → ICS

T0838 · Modify Alarm Settings

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0839 · Module Firmware

assetIds: [empty list] → A0003, A0010, A0017, A0018

views: [empty list] → ICS

T0840 · Network Connection Enumeration

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0842 · Network Sniffing

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0843 · Program Download

views: ICS, Embedded → ICS

T0845 · Program Upload

views: ICS, Embedded → ICS

T0846 · Remote System Discovery

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0847 · Replication Through Removable Media

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0848 · Rogue Master

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0849 · Masquerading

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0851 · Rootkit

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0852 · Screen Capture

views: ICS, Embedded, Windows, Linux → ICS

T0853 · Scripting

assetIds: [empty list] → A0001, A0002, A0006, A0007, A0008, A0009, A0012, A0015, A0016

views: [empty list] → ICS

T0855 · Unauthorized Command Message

assetIds: [empty list] → A0002, A0003, A0004, A0005, A0007, A0010, A0017, A0018

views: [empty list] → ICS

T0856 · Spoof Reporting Message

assetIds: [empty list] → A0002, A0003, A0004, A0005, A0007, A0009, A0010, A0017, A0018

views: [empty list] → ICS

T0857 · System Firmware

assetIds: [empty list] → A0002, A0003, A0004, A0005, A0009, A0010, A0011, A0015, A0016, A0017

views: [empty list] → ICS

T0858 · Change Operating Mode

views: ICS, Embedded → ICS

T0859 · Valid Accounts

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0860 · Wireless Compromise

views: ICS, Embedded, Windows, Linux → ICS

T0861 · Point & Tag Identification

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0862 · Supply Chain Compromise

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0863 · User Execution

views: ICS, Embedded, Windows, Linux → ICS

T0864 · Transient Cyber Asset

views: ICS, Windows, Linux → ICS

T0865 · Spearphishing Attachment

views: ICS, Embedded, Windows, Linux → ICS

T0866 · Exploitation of Remote Services

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0867 · Lateral Tool Transfer

views: ICS, Embedded, Windows, Linux → ICS

T0868 · Detect Operating Mode

views: ICS, Embedded → ICS

T0869 · Standard Application Layer Protocol

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0871 · Execution through API

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0872 · Indicator Removal on Host

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0873 · Project File Infection

views: ICS, Windows, Linux → ICS

T0874 · Hooking

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0877 · I/O Image

views: ICS, Embedded → ICS

T0878 · Alarm Suppression

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0881 · Service Stop

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0883 · Internet Accessible Device

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0884 · Connection Proxy

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0885 · Commonly Used Port

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0886 · Remote Services

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0887 · Wireless Sniffing

views: ICS, Embedded, Windows, Linux → ICS

T0888 · Remote System Information Discovery

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0889 · Modify Program

views: ICS, Embedded → ICS

T0890 · Exploitation for Privilege Escalation

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0891 · Hardcoded Credentials

assetIds: [empty list] → A0013

views: [empty list] → ICS

T0892 · Change Credential

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0893 · Data from Local System

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0894 · System Binary Proxy Execution

views: ICS, Embedded, Windows, Linux → ICS

T0895 · Autorun Image

views: ICS, Embedded, Windows, Linux → ICS

Release snapshots, not process historization.

These comparisons reconstruct published releases, not every intermediate edit. They are suitable for citing an assessment baseline or reviewing knowledge-base changes—not for proving when attackers first used a technique, when a vulnerability appeared, or when a site became exposed.

For original values in fields outside the projected technique detail, download each release’s From source ZIP and To source ZIP. All revoked/deprecated objects and relationships are preserved.

What changed?

127 matching changes

platforms

views

platforms

views

platforms

views

assetIds

views

revoked

assetIds

views

revoked

assetIds

views

revoked

platforms

views

assetIds

views

deprecated

platforms

views

platforms

views

assetIds

views

revoked

platforms

views

platforms

views

platforms

views

platforms

views

platforms

views

platforms

views

platforms

views

platforms

views

platforms

views

platforms

views

platforms

views

platforms

views

platforms

views

assetIds

views

revoked

platforms

views

platforms

views

platforms

views

platforms

views

description

platforms

views

T0800 · Activate Firmware Update Mode

T0801 · Monitor Process State

T0802 · Automated Collection

T0803 · Block Command Message

T0804 · Block Reporting Message

T0805 · Block Serial COM

T0806 · Brute Force I/O

T0807 · Command-Line Interface

T0809 · Data Destruction

T0811 · Data from Information Repositories

T0812 · Default Credentials