>> Welcome to the 8th and final lesson of Module 1.
How ATT&CK grows and evolves.
In this lesson, we will explore
how and why ATT&CK changes over time.
Recognize how to track and monitor these changes,
and finally, identify how
to access previous versions of ATT&CK.
Adversaries, malware, and
the behaviors evolve every day,
and to keep up with this, ATT&CK
is very much a living framework.
Techniques group software and the various objects within
ATT&CK were all designed to evolve and grow over time.
As I need to add, deprecate
or even enhanced content is very much needed.
The MITRE ATT&CK team has
continuous processes for vetting
and modifying ATT&CK content,
including keeping up with
publicly available cyber threat intelligence and
making appropriate changes to
techniques and sub-techniques,
as well as their mappings to groups and software.
To highlight this growth, let's take a look at one of
the first matrix is produced by the ATT&CK team.
This is the enterprise matrix from around 2014.
As you can see, this matrix only has
eight tactics and around 60 techniques.
Compare that to the most recent version
of ATT&CK, version 8,
where the enterprise matrix has
14 tactics and over
500 combined techniques and sub-techniques.
This may seem like a lot of growth,
but think about how many hash values,
IP addresses, and domain names and
other artifacts have been produced
by adversaries since 2014.
ATT&CK is typically updated twice a year,
and there are various ways you can track these changes.
The first of which is updates and modifications to
the STIX content hosted in
this MITRE CTI GitHub repository.
This STIX content is what populates the ATT&CK website.
But you can also see these changes
either update logs hosted on the site,
which will include descriptions
and notes for each release.
While ATT&CK continues to grow and evolve over time,
there may come a need to
access previous versions of ATT&CK.
Version dating back to version
3 are still hosted on the website.
While the ATT&CK team does a lot of work
to grow and evolve ATT&CK,
we really do depend on the
community to keep ATT&CK growing.
Contributor guidance as well as
examples is available on the site,
and definitely feel free to reach
out to attack@mitre.org for
any ideas or intelligence that can
be in use to grow and enhance the model.
With that, we've reached the end of Lesson 8.
In our knowledge check, complete the following sentence.
ATT&CK is, please pause
the video and take a second to
select the correct answer before proceeding.
As much as I would love to say ATT&CK is perfect,
the correct answer is C. ATT&CK is constantly
evolving over time and
anyone can submit the contribution.
In summary, ATT&CK grows to
keep up with the evolution of threats and adversaries,
and these changes can be monitored
through update to the STIX
or updates tracked in our logs on the site.
Finally, previous version of ATT&CK
are still hosted on our site going back to Version 3.
With that, we've reached the end of Module 1.
In summary, ATT&CK was created
based on the need to understand and adapt to
our adversaries and captures the TTP's of
real-world adversary behaviors and maps
these TTPs to groups
and software which execute these behaviors.
I definitely recommend visiting our site attack@mitre.org
to get a hands-on feel for
the ATT&CK and all the information captured.
But for more great information,
check out our designer philosophy paper
as well as our Getting Started Guide.