7 min read
|
Saved February 14, 2026
|
Copied!
Do you care about this?
This article outlines the updates in MITRE ATT&CK v18, focusing on new Detection Strategies and Analytics that enhance the framework's usability for cyber defenders. It details improvements in coverage across various domains, including enterprise, mobile, and industrial control systems, as well as the introduction of the ATT&CK Advisory Council for community input.
If you do, here's more
MITRE ATT&CK® has rolled out significant updates in version 18, focusing on enhancing detection capabilities for defenders. The introduction of two new objects, Detection Strategies and Analytics, marks a shift from simple notes to comprehensive, behavior-oriented strategies. This change aims to help security teams better understand and respond to adversary tactics. The Workbench tool now supports these updates, encouraging users to upgrade for full benefits.
The update expands coverage across various domains. In the enterprise sector, it includes new techniques relevant to modern infrastructures like Kubernetes and CI/CD pipelines, highlighting behaviors such as ransomware preparation and threat intelligence monitoring by adversaries. The article details specific techniques, like using container CLI commands to execute malicious actions and discovering local storage for maximum disruption. In mobile and industrial control system (ICS) environments, enhanced coverage addresses state-sponsored abuse and the representation of industrial equipment.
Future plans include the ATT&CK Advisory Council to gather community feedback and shape the framework's direction. The article raises key questions about the evolving use of AI in attacks and the complexities of categorizing social engineering tactics. The goal is to refine and expand the framework based on real-world data and emerging threats, ensuring it remains relevant and actionable for organizations facing increasing security challenges.
Questions about this article
No questions yet.