MITRE released ATT&CK v20 on 13 October 2026, updating techniques, groups, campaigns and software across Enterprise, Mobile and ICS (MITRE). For ICS the release notes list nine new techniques, two new campaigns, a new mitigation and two deprecations: Command-Line Interface (T0807) and Scripting (T0853).

The deprecations will quietly cost someone a quarter of work. In the v19.1 data, T0807 carried eight procedure examples, two mitigations and a detection relationship; T0853 carried seven, three and one. In the v20 bundle both carry zero relationships of any kind, and nothing in the data says where that content went (ATT&CK STIX data, files ics-attack-19.1.json and ics-attack-20.0.json).

Deprecated is not revoked, and the difference is machine-readable

MITRE's own usage documentation draws the line. Objects "deemed no longer beneficial to track as part of the knowledge base are marked as deprecated", while "objects which are replaced by a different object are revoked", and for a revoked object "a relationship of type revoked-by is also created targeting the replacing object". Both stay in the knowledge base "so that workflows relying on those objects are not broken", and MITRE recommends filtering them out because they "are no longer maintained by ATT&CK" (ATT&CK STIX data usage).

ICS has had both inside six months. In v19, released 28 April 2026, nine ICS techniques were revoked into new sub-techniques, among them Default Credentials (T0812) to T1694.001, Unauthorized Command Message (T0855) to T1692.001 and System Firmware (T0857) to T1693.001 (MITRE). Every one of those carries a revoked-by pointer, so a tool that follows the data can re-map itself.

T0807 and T0853 do not. They are deprecated, not revoked, which means no pointer exists even though a successor plainly does. Twenty-three of 127 ICS technique entries in v20 are deprecated or revoked.

Where the content actually went

Command and Scripting Interpreter (T1701) was created on 25 September 2026 and last modified on 9 October. It sits under the Execution tactic in the ICS matrix with six sub-techniques: PowerShell (T1701.001), Windows Command Shell (T1701.002), Unix Shell (T1701.003), Visual Basic (T1701.004), Python (T1701.005) and JavaScript (T1701.006) (MITRE). The eleven asset classes it targets all sit between the enterprise and the process: workstations, HMIs, historians, control and application servers, data gateways, jump hosts, VPN servers and network gear, not the PLCs below them.

The procedure examples moved with it. T1701 and its sub-techniques now carry 21 usage mappings from 13 distinct sources, among them Stuxnet, Industroyer, Triton, FrostyGoop and the newly added IOControl, the groups Sandworm Team, OilRig and APT33, and campaigns covering the 2016 and 2022 Ukraine electric power attacks and the Triton safety instrumented system attack. Standard Application Layer Protocol also gained two sub-techniques on 26 September 2026, DNS (T0869.001) and Publish/Subscribe Protocols (T0869.002).

Nine new detection strategies, and the telemetry they assume

ATT&CK v18, released 28 October 2025, replaced per-technique detection notes with Detection Strategies and Analytics and deprecated Data Sources (MITRE). v20 adds nine ICS strategies under that model, DET0928 through DET0936, covering command and scripting abuse generally, each of the six interpreters, and DNS and publish/subscribe misuse for command and control. The ICS bundle now holds 106 detection strategies and 302 analytics, the new ones split across Windows, Linux, Network Devices and Embedded.

Two things stand out in the analytics themselves. First, the log sources named are ordinary IT telemetry: Sysmon process creation, network connection and module load events, Windows Security 4688, PowerShell 4103 and 4104 script block content, auditd execve records, osquery socket events, network device CLI logs and network monitoring for flow, content and DNS. On an engineering workstation that is achievable. On an embedded field device it mostly is not, and the analytics say so themselves, qualifying device CLI command audit with "when available". Where it is not, network monitoring is the only source left.

Second, these analytics are correlation rules, not signatures. The Windows analytic under DET0928 looks for an interpreter spawned by an ICS vendor application process "where this parent-child relationship is not part of the documented normal operation". The publish/subscribe analytics require a communication matrix violation plus process, destination and protocol context, and the embedded variant asks for deviation from a device-specific profile. None of that fires without a documented baseline of what each asset should talk to.

That is the real cost of these strategies, and the gap 2026 data keeps finding. Only 21 percent of the 603 OT security leaders in Honeywell's 2026 OT Cybersecurity Benchmark report a complete asset inventory (Honeywell), covered here, and Forescout found only 13 percent of segments containing OT devices contained OT and nothing else, covered here. A detection that depends on an approved communication matrix is unimplementable until somebody writes one.

The new campaign entry your coverage matrix will miss

v20 adds 2026 U.S. Water Utilities Attacks (C0066). ATT&CK's entry describes a campaign against more than 30 municipal water and wastewater utilities in Minnesota beginning 27 July 2026, amid a wider pattern the FBI and EPA reported across at least seven U.S. states, in which the adversary reached internet-facing Allen-Bradley MicroLogix 1100 and 1400 PLCs through cellular gateways and changed their IP addresses and passwords to lock operators out (MITRE).

Its nine technique mappings include Insecure Credentials: Default Credentials (T1694.001), the identifier that replaced the revoked T0812 in April. A coverage matrix still keyed to T0812 shows no hit against the newest water campaign in the knowledge base, while reporting coverage of a technique that no longer exists.

The exposure behind it is measurable. Forescout Research, in a 5 August 2026 vendor blog, counted 4,407 internet-facing controllers exposing port 44818 on 3 August, 65 percent of them in the United States, and found 70 percent of US-based controllers sitting in large mobile carrier networks reached through cellular routers. Forescout also states there is no confirmation of any CVE exploited in the campaign (Forescout). Cellular gateways bypassing the perimeter is the same pattern we wrote about in internet-exposed Siemens S7 PLCs and in yesterday's French refrigeration controllers.

What to do this week

  1. Search your detection content and assessment artefacts for the dead identifiers. T0807 and T0853 from this release, and the nine revoked in April: T0803, T0804, T0805, T0812, T0839, T0855, T0856, T0857, T0891. Rules, dashboards, coverage spreadsheets, assessment templates.
  2. Decide what your tooling does with deprecated objects. Filter them and the coverage disappears without a message. Keep them and you report coverage of a technique with no mappings, mitigations or detections. Neither is acceptable until you have re-mapped.
  3. Re-map T0807 and T0853 to T1701 by hand. No revoked-by pointer exists to automate it, and the six sub-techniques are more specific than what they replace, so it is a judgement call per rule.
  4. Record the ATT&CK version on every mapped artefact. An assessment that does not state which version it was built against cannot be re-validated.
  5. Check the telemetry the new analytics name, on the hosts T1701 targets. Process creation with command line and parent, PowerShell script block logging, auditd execve, on engineering workstations, HMIs, historians and jump hosts. Then check whether any of it reaches your SOC.
  6. Write the communication matrix the new strategies assume. Which asset may talk to which broker, resolver and zone. Without it the analytics have no baseline and will stay silent or drown you.

Where MBCTG fits

A framework update is only administrative work if your detection content was never mapped at all. If it was, this one carries a silent failure mode: identifiers that still resolve to a page, with nothing behind them.

The prerequisites for the new strategies are the capabilities every 2026 survey finds missing. Passive asset visibility produces the inventory and the observed communication baseline without touching a controller, the foundation of our OT security services, and MITRE ATT&CK for ICS is one of the frameworks we map that work against. Maintaining detection content as the knowledge base moves under it, and getting an alert to a human quickly, is what our 24/7 SOC carries. Re-validating ATT&CK-mapped assessments, zone and conduit documentation and questionnaire answers that cite technique identifiers is compliance and GRC work, and the SP 800-82r4 draft emphasises asset management and network monitoring for the same reason.

If you cannot say which ATT&CK version your OT detection coverage was mapped against, talk to an MBCTG expert. T0807 and T0853 will keep rendering a page for years. They stopped meaning anything on 13 October.