ATT&CK v17: New Platform (ESXi), Collection Optimization, & More Countermeasures
Brief
By: Amy Robertson and Adam Pennington
Our goal with ATT&CK v17 is to help defenders stay aligned with where adversaries are headed by looking at where they’ve recently been. This release aims to inform defensive efforts by focusing on the platforms adversaries are exploiting, the techniques they’re adapting, and the environments they’re targeting.
- Enterprise now includes the ESXi platform , reflecting the rise in attacks on virtualization infrastructure. We also renamed the Network platform to Network Devices (because let’s call things what they are).
- On the Defensive side, we’ve made Data Components more useful, showing you how to collect , not just what, with platform-specific tips and tools . Mitigations also got an upgrade, with more guidance, real-world examples, and integration tips.
