DF/danfisher.devSystems / security / field notes
← Resources

Reference-data history

What changed?

Compare published MITRE ATT&CK® for ICS snapshots. Track edits and relationships without confusing a dataset release with the date a behavior first occurred.

From v20.0 (2026-10-13) → To v19.2 (2026-08-05). Added/removed mean present/absent relative to these snapshots, not newly invented/deleted behavior. Revoked and deprecated are retained source statuses. “Modified” includes metadata-only edits.

added0
modified85
revoked0
deprecated0
removed9

Counts above cover Techniques, before the Change type filter. 837 source objects changed across all types; 2566 objects in From and 2173 in To. Objects are matched by STIX ID and every top-level field is hashed independently. Formatting and JSON key order alone do not produce changes.

94 matching changes

v20.0 → v19.2 · page 1 of 2 · up to 50 objects per page
ObjectChangeSource fields changedVersions / status
T0800 · Activate Firmware Update Modeattack-pattern--19a71d1e-6334-4233-8260-b749cae37953Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0801 · Monitor Process Stateattack-pattern--2d0d40ad-22fa-4cc8-b264-072557e1364bTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0802 · Automated Collectionattack-pattern--3de230d4-3e42-4041-b089-17e1128fededTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux

To

None

views

From

ICS, Embedded, Windows, Linux

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0806 · Brute Force I/Oattack-pattern--8e7089d3-fba2-44f8-94a8-9a79c53920c4Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux

To

None

views

From

ICS, Embedded, Windows, Linux

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0807 · Command-Line Interfaceattack-pattern--24a9253e-8948-4c98-b751-8e2aee53127cTechniques
Inspect 3 changed projected field(s)

assetIds

From

[empty list]

To

A0001, A0002, A0006, A0007, A0008, A0009, A0012, A0015, A0016

views

From

[empty list]

To

ICS

deprecated

From

true

To

false

modifiedmodified, x_mitre_deprecated

From: 1.1 · deprecated · source

To: 1.1 · source

T0809 · Data Destructionattack-pattern--493832d9-cea6-4b63-abe7-9a65a6473675Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0811 · Data from Information Repositoriesattack-pattern--3405891b-16aa-4bd7-bd7c-733501f9b20fTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux

To

None

views

From

ICS, Embedded, Windows, Linux

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0814 · Denial of Serviceattack-pattern--1b22b676-9347-4c55-9a35-ef0dc653db5bTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0816 · Device Restart/Shutdownattack-pattern--25dfc8ad-bd73-4dfd-84a9-3c3d383f76e9Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0817 · Drive-by Compromiseattack-pattern--7830cfcf-b268-4ac0-a69e-73c6affbae9aTechniques
Inspect 2 changed projected field(s)

platforms

From

Windows, Linux

To

None

views

From

ICS, Windows, Linux

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0819 · Exploit Public-Facing Applicationattack-pattern--32632a95-6856-47b9-9ab7-fea5cd7dce00Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0820 · Exploitation for Evasionattack-pattern--9f947a1c-3860-48a8-8af0-a2dfa3efde03Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0821 · Modify Controller Taskingattack-pattern--09a61657-46e1-439e-b3ed-3e4556a78243Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded

To

None

views

From

ICS, Embedded

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0822 · External Remote Servicesattack-pattern--8d2f3bab-507c-4424-b58b-edc977bd215cTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0823 · Graphical User Interfaceattack-pattern--b0628bfc-5376-4a38-9182-f324501cb4cfTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0830 · Adversary-in-the-Middleattack-pattern--9a505987-ab05-4f46-a9a6-6441442eec3bTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 2.0 · source

To: 2.0 · source

T0834 · Native APIattack-pattern--b52870cc-83f3-473c-b895-72d91751030bTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0835 · Manipulate I/O Imageattack-pattern--36e9f5bc-ac13-4da4-a2f4-01f4877d9004Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded

To

None

views

From

ICS, Embedded

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0836 · Modify Parameterattack-pattern--097924ce-a9a9-4039-8591-e0deedfb8722Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux

To

None

views

From

ICS, Embedded, Windows, Linux

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.3 · source

To: 1.3 · source

T0838 · Modify Alarm Settingsattack-pattern--e5de767e-f513-41cd-aa15-33f6ce5fbf92Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0840 · Network Connection Enumerationattack-pattern--ea0c980c-5cf0-43a7-a049-59c4c207566eTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0842 · Network Sniffingattack-pattern--38213338-1aab-479d-949b-c81b66ccca5cTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0843 · Program Downloadattack-pattern--be69c571-d746-4b1f-bdd0-c0c9817e9068Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded

To

None

views

From

ICS, Embedded

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0843.001 · Download Allattack-pattern--77015a55-eef8-4f71-a071-b152f82ec1efTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded

To

[field absent]

views

From

ICS, Embedded

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0843.002 · Online Editattack-pattern--d85a6ee9-820c-4adf-8a64-2392ee70c83cTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded

To

[field absent]

views

From

ICS, Embedded

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0843.003 · Program Appendattack-pattern--574d5bfb-9a7a-4b28-ab5c-743ac704c135Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded

To

[field absent]

views

From

ICS, Embedded

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0845 · Program Uploadattack-pattern--3067b85e-271e-4bc5-81ad-ab1a81d411e3Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded

To

None

views

From

ICS, Embedded

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0846 · Remote System Discoveryattack-pattern--d5a69cfb-fc2a-46cb-99eb-74b236db5061Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0846.001 · Port Scanattack-pattern--5d24bb1d-4487-4923-ae3a-8e679092ac7aTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

[field absent]

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0846.002 · Broadcast Discoveryattack-pattern--c55f0be5-044e-4577-8095-65b37680d28cTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

[field absent]

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0846.003 · Multicast Discoveryattack-pattern--64bbc1b2-101f-4322-af1d-0c9cc25cef91Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

[field absent]

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0847 · Replication Through Removable Mediaattack-pattern--c267bbee-bb59-47fe-85e0-3ed210337c21Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0848 · Rogue Masterattack-pattern--b14395bd-5419-4ef4-9bd8-696936f509bbTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0849 · Masqueradingattack-pattern--ba203963-3182-41ac-af14-7e7ebc83cd61Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0851 · Rootkitattack-pattern--3b6b9246-43f8-4c69-ad7a-2b11cfe0a0d9Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0852 · Screen Captureattack-pattern--c5e3cdbc-0387-4be9-8f83-ff5c0865f377Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux

To

None

views

From

ICS, Embedded, Windows, Linux

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0853 · Scriptingattack-pattern--2dc2b567-8821-49f9-9045-8740f3d0b958Techniques
Inspect 3 changed projected field(s)

assetIds

From

[empty list]

To

A0001, A0002, A0006, A0007, A0008, A0009, A0012, A0015, A0016

views

From

[empty list]

To

ICS

deprecated

From

true

To

false

modifiedmodified, x_mitre_attack_spec_version, x_mitre_deprecated

From: 1.0 · deprecated · source

To: 1.0 · source

T0858 · Change Operating Modeattack-pattern--2883c520-7957-46ca-89bd-dab1ad53b601Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded

To

None

views

From

ICS, Embedded

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0859 · Valid Accountsattack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0860 · Wireless Compromiseattack-pattern--2877063e-1851-48d2-bcc6-bc1d2733157eTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux

To

None

views

From

ICS, Embedded, Windows, Linux

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0861 · Point & Tag Identificationattack-pattern--25852363-5968-4673-b81d-341d5ed90bd1Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0862 · Supply Chain Compromiseattack-pattern--5e0f75da-e108-4688-a6de-a4f07cc2cbe3Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0863 · User Executionattack-pattern--2736b752-4ec5-4421-a230-8977dea7649cTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux

To

None

views

From

ICS, Embedded, Windows, Linux

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0864 · Transient Cyber Assetattack-pattern--35392fb4-a31d-4c6a-b9f2-1c65b7f5e6b9Techniques
Inspect 2 changed projected field(s)

platforms

From

Windows, Linux

To

None

views

From

ICS, Windows, Linux

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.2 · source

To: 1.2 · source

T0865 · Spearphishing Attachmentattack-pattern--648f995e-9c3a-41e4-aeee-98bb41037426Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux

To

None

views

From

ICS, Embedded, Windows, Linux

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0866 · Exploitation of Remote Servicesattack-pattern--85a45294-08f1-4539-bf00-7da08aa7b0eeTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0867 · Lateral Tool Transferattack-pattern--ead7bd34-186e-4c79-9a4d-b65bcce6ed9dTechniques
Inspect 3 changed projected field(s)

description

From

Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation.(Citation: Enterprise ATT&CK) Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares.(Citation: Enterprise ATT&CK) In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks.

To

Adversaries may transfer tools or other files from one system to another to stage adversary tools or other files over the course of an operation. (Citation: Enterprise ATT&CK) Copying of files may also be performed laterally between internal victim systems to support Lateral Movement with remote Execution using inherent file sharing protocols such as file sharing over SMB to connected network shares. (Citation: Enterprise ATT&CK) In control systems environments, malware may use SMB and other file sharing protocols to move laterally through industrial networks.

platforms

From

Embedded, Windows, Linux

To

None

views

From

ICS, Embedded, Windows, Linux

To

ICS

modifieddescription, modified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.1 · source

To: 1.1 · source

T0868 · Detect Operating Modeattack-pattern--2aa406ed-81c3-4c1d-ba83-cfbee5a2847aTechniques
Inspect 2 changed projected field(s)

platforms

From

Embedded

To

None

views

From

ICS, Embedded

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0869 · Standard Application Layer Protocolattack-pattern--e076cca8-2f08-45c9-aff7-ea5ac798b387Techniques
Inspect 2 changed projected field(s)

platforms

From

Embedded, Windows, Linux, Network Devices

To

None

views

From

ICS, Embedded, Windows, Linux, Network Devices

To

ICS

modifiedmodified, x_mitre_attack_spec_version, x_mitre_platforms

From: 1.0 · source

To: 1.0 · source

T0869.001 · DNSattack-pattern--1aa2bf29-6015-4c8f-a15a-21ae0aff64deTechniquesremovedcreated, created_by_ref, description, external_references, id, kill_chain_phases, modified, name, object_marking_refs, revoked, spec_version, type, x_mitre_attack_spec_version, x_mitre_deprecated, x_mitre_domains, x_mitre_is_subtechnique, x_mitre_modified_by_ref, x_mitre_version

From: 1.0 · source

To: absent

Derived technique/asset membership changes (85 techniques)

A relationship edit can change targeted assets or hierarchy without modifying the technique object itself. These computed differences are separate from the source-object counts above. Website-rule membership in older releases may be reconstructed, not observed.

T0800 · Activate Firmware Update Mode

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0801 · Monitor Process State

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0802 · Automated Collection

views: ICS, Embedded, Windows, Linux → ICS

T0806 · Brute Force I/O

views: ICS, Embedded, Windows, Linux → ICS

T0807 · Command-Line Interface

assetIds: [empty list] → A0001, A0002, A0006, A0007, A0008, A0009, A0012, A0015, A0016

views: [empty list] → ICS

T0809 · Data Destruction

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0811 · Data from Information Repositories

views: ICS, Embedded, Windows, Linux → ICS

T0814 · Denial of Service

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0816 · Device Restart/Shutdown

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0817 · Drive-by Compromise

views: ICS, Windows, Linux → ICS

T0819 · Exploit Public-Facing Application

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0820 · Exploitation for Evasion

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0821 · Modify Controller Tasking

views: ICS, Embedded → ICS

T0822 · External Remote Services

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0823 · Graphical User Interface

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0830 · Adversary-in-the-Middle

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0834 · Native API

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0835 · Manipulate I/O Image

views: ICS, Embedded → ICS

T0836 · Modify Parameter

views: ICS, Embedded, Windows, Linux → ICS

T0838 · Modify Alarm Settings

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0840 · Network Connection Enumeration

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0842 · Network Sniffing

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0843 · Program Download

views: ICS, Embedded → ICS

T0843.001 · Download All

views: ICS, Embedded → ICS

T0843.002 · Online Edit

views: ICS, Embedded → ICS

T0843.003 · Program Append

views: ICS, Embedded → ICS

T0845 · Program Upload

views: ICS, Embedded → ICS

T0846 · Remote System Discovery

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0846.001 · Port Scan

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0846.002 · Broadcast Discovery

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0846.003 · Multicast Discovery

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0847 · Replication Through Removable Media

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0848 · Rogue Master

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0849 · Masquerading

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0851 · Rootkit

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0852 · Screen Capture

views: ICS, Embedded, Windows, Linux → ICS

T0853 · Scripting

assetIds: [empty list] → A0001, A0002, A0006, A0007, A0008, A0009, A0012, A0015, A0016

views: [empty list] → ICS

T0858 · Change Operating Mode

views: ICS, Embedded → ICS

T0859 · Valid Accounts

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0860 · Wireless Compromise

views: ICS, Embedded, Windows, Linux → ICS

T0861 · Point & Tag Identification

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0862 · Supply Chain Compromise

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0863 · User Execution

views: ICS, Embedded, Windows, Linux → ICS

T0864 · Transient Cyber Asset

views: ICS, Windows, Linux → ICS

T0865 · Spearphishing Attachment

views: ICS, Embedded, Windows, Linux → ICS

T0866 · Exploitation of Remote Services

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0867 · Lateral Tool Transfer

views: ICS, Embedded, Windows, Linux → ICS

T0868 · Detect Operating Mode

views: ICS, Embedded → ICS

T0869 · Standard Application Layer Protocol

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0871 · Execution through API

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0872 · Indicator Removal on Host

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0873 · Project File Infection

views: ICS, Windows, Linux → ICS

T0873.001 · Siemens Project File Format

views: ICS, Windows, Linux → ICS

T0874 · Hooking

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0877 · I/O Image

views: ICS, Embedded → ICS

T0878 · Alarm Suppression

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0881 · Service Stop

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0883 · Internet Accessible Device

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0884 · Connection Proxy

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0885 · Commonly Used Port

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0886 · Remote Services

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0887 · Wireless Sniffing

views: ICS, Embedded, Windows, Linux → ICS

T0888 · Remote System Information Discovery

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0889 · Modify Program

views: ICS, Embedded → ICS

T0890 · Exploitation for Privilege Escalation

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0892 · Change Credential

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0893 · Data from Local System

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T0894 · System Binary Proxy Execution

views: ICS, Embedded, Windows, Linux → ICS

T0895 · Autorun Image

views: ICS, Embedded, Windows, Linux → ICS

T1691 · Block Operational Technology Message

views: ICS, Embedded, Windows, Linux → ICS

T1691.001 · Command Message

views: ICS, Embedded, Windows, Linux → ICS

T1691.002 · Reporting Message

views: ICS, Embedded, Windows, Linux → ICS

T1692 · Unauthorized Message

views: ICS, Embedded, Windows, Linux → ICS

T1692.001 · Command Message

views: ICS, Embedded, Windows, Linux → ICS

T1692.002 · Reporting Message

views: ICS, Embedded, Windows, Linux → ICS

T1693 · Modify Firmware

views: ICS, Embedded → ICS

T1693.001 · System Firmware

views: ICS, Embedded → ICS

T1693.002 · Module Firmware

views: ICS, Embedded → ICS

T1694 · Insecure Credentials

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T1694.001 · Default Credentials

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T1694.002 · Hardcoded Credentials

views: ICS, Embedded → ICS

T1695 · Block Communications

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T1695.001 · Serial COM

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T1695.002 · Ethernet

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

T1695.003 · Wi-Fi

views: ICS, Embedded, Windows, Linux, Network Devices → ICS

Release snapshots, not process historization.

These comparisons reconstruct published releases, not every intermediate edit. They are suitable for citing an assessment baseline or reviewing knowledge-base changes—not for proving when attackers first used a technique, when a vulnerability appeared, or when a site became exposed.

For original values in fields outside the projected technique detail, download each release’s From source ZIP and To source ZIP. All revoked/deprecated objects and relationships are preserved.

© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.

MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. Independent presentation and labeled interpretation by Dan Fisher; not affiliated with or endorsed by MITRE or Emerson. Source content retains MITRE’s license and disclaimers, not the site’s CC BY teaching-material license.

No installed asset, control, or detection has been assessed. No connection to the private lab; no scanning or live-system testing is authorized.