MITRE unveiled ATT&CK v20 on October 13, incorporating nine new Enterprise techniques focused on targeting AI systems, stealing application-specific passwords to bypass MFA, and evading CAPTCHA checks This article explores detection tactics incorporating. . For security teams, the enhancements offer a clearer mapping of activities they already observe across business networks, AI tools, phones, and industrial systems.

The ATT&CK ID Technique / Sub-Technique Type Description T1697 Steal Application-Specific Passwords Technique Attackers use phishing, generation, or theft of application-specific passwords to bypass MFA checks and gain unauthorized access. In the Industrial Control Systems (ICS) domain, MITRE added the Command and Scripting Interpreter technique, along with several sub-techniques for PowerShell, Windows Command Shell, Unix Shell, Visual Basic, Python, and JavaScript.

Additionally, new sub-techniques cover DNS and publish/subscribe protocols utilized for command and control, which is crucial in industrial environments where defenders must distinguish between unusual activity and normal control and engineering tasks. MITRE introduced enhanced ICS detection tactics, incorporating platform and asset context, enabling teams to identify whether a detection applies to a Windows workstation, network device, or embedded system. No.

14 Identifying Suspicious Visual Basic Execution in Industrial Control Systems. The main benefit of v20 is not just the number of new entries but how it connects emerging AI risks with familiar access methods, using the same framework used to track malware, credentials, and activity in industrial networks.