ATT&CK v20

CHANGELOG.md

@@ -1,5 +1,12 @@
 # Website Changelog
 
+## v5.2.0 (2026-10-13)
+
+### Features
+
+* Release ATT&CK content version 20.0.
+  See detailed changes [here](https://github.com/mitre/cti/releases/tag/ATT%26CK-v20.0).
+
 ## v5.1.0 (2026-09-21)
 
 ### Features

custom_jinja_filters.py

@@ -159,10 +159,18 @@ def remove_citations(data):
 def filter_urls(data):
     """Filters out URLs to return path and not domain."""
     if not pelican_settings["no_stix_link_replacement"]:
+        if "https://attack.mitre.org/assets/" in data:
+            data = data.replace("https://attack.mitre.org/assets/", "/assets/")
+        if "https://attack.mitre.org/campaigns/" in data:
+            data = data.replace("https://attack.mitre.org/campaigns/", "/campaigns/")
         if "https://attack.mitre.org/groups/" in data:
             data = data.replace("https://attack.mitre.org/groups/", "/groups/")
         if "https://attack.mitre.org/software/" in data:
             data = data.replace("https://attack.mitre.org/software/", "/software/")
+        if "https://attack.mitre.org/mitigations/" in data:
+            data = data.replace("https://attack.mitre.org/mitigations/", "/mitigations/")
+        if "https://attack.mitre.org/tactics/" in data:
+            data = data.replace("https://attack.mitre.org/tactics/", "/tactics/")
         if "https://attack.mitre.org/techniques/" in data:
             data = data.replace("https://attack.mitre.org/techniques/", "/techniques/")
         if "https://attack.mitre.org/technique/" in data:

data/versions.json

@@ -1,11 +1,19 @@
 {
     "current": {
-        "name": "v19.2",
+        "name": "v20.0",
         "date_start": "April 28, 2026",
         "changelog": "updates-august-2026",
-        "cti_url": "https://github.com/mitre/cti/releases/tag/ATT%26CK-v19.2"
+        "cti_url": "https://github.com/mitre/cti/releases/tag/ATT%26CK-v20.0"
     },
     "previous": [
+        {
+            "name": "v19.2",
+            "date_start": "April 28, 2026",
+            "date_end": "October 12, 2026",
+            "changelog": "updates-august-2026",
+            "cti_url": "https://github.com/mitre/cti/releases/tag/ATT%26CK-v19.2",
+            "commit": "ede2b5c8d593762ed83a5a269fd40b3e3a826054"
+        },
         {
             "name": "v18.1",
             "date_start": "October 28, 2025",

modules/datasources/templates/datasources-index.html

@@ -30,7 +30,7 @@
           <h1>Data Sources</h1>
           {{ deprecated.deprecated("Data sources were deprecated in the ATT&CK v18 release in October 2025.
             You can read more about the details of this change in our <a href='https://medium.com/mitre-attack/smarter-detection-strategies-in-attack-7e6738fec31f'>What Comes After Detection Rules? Smarter Detection Strategies in ATT&CK</a> blog post
-            and our <a href='https://attack.mitre.org/resources/updates/updates-october-2025/'>ATT&CK v18 release notes</a>.
+            and our <a href='/resources/updates/updates-october-2025/'>ATT&CK v18 release notes</a>.
             The data sources page will remain available for reference, but no new data sources will be added to the framework.") }}
           <br>
           <p>Data sources represent the various subjects/topics of information that can be collected by sensors/logs.

modules/detectionstrategies/detectionstrategies.py

@@ -77,6 +77,22 @@ def generate_markdown_files():
 
     return has_detection_strategies
 
+def get_detection_assets(technique_list):
+    """Get assets for each detection targeted by a technique"""
+    assets = []
+    for technique in technique_list or []:
+        stix_id = technique["object"]["id"]
+        technique_assets = util.relationshipgetters.get_assets_targeted_by_techniques().get(stix_id)
+
+        assets.extend([
+            {
+                "id": util.buildhelpers.get_attack_id(asset["object"]),
+                "asset": asset["object"]["name"]
+            }
+            for asset in technique_assets or []
+        ])
+
+    return sorted(assets, key=lambda asset: asset["id"])
 
 def get_detection_strategy_table(detection_strategy_list):
     """Generate detection strategy table for the overview page."""
@@ -107,6 +123,9 @@ def generate_detection_strategy_md(detection_strategy, notes):
     if not attack_id:
         return
 
+    stix_id = detection_strategy["id"]
+    techniques = util.relationshipgetters.get_techniques_detected_by_detectionstrategy().get(stix_id)
+    assets = get_detection_assets(techniques)
     dates = util.buildhelpers.get_created_and_modified_dates(detection_strategy)
 
     # Build reference list
@@ -131,6 +150,7 @@ def generate_detection_strategy_md(detection_strategy, notes):
         "analytics": analytics_by_platform,
         "analytic_ids": analytic_ids,
         "versioning_feature": site_config.check_versions_module(),
+        "assets": assets,
     }
 
     subs = detectionstrategies_config.detectionstrategy_md.substitute(data)

modules/detectionstrategies/templates/detectionstrategy.html

@@ -209,6 +209,32 @@ <h5 class="pt-3" id="{{analytic.id}}-mutable-elements">Mutable Elements</h5>
         </div>
         {% endif %}
 
+        {% if parsed.assets %}
+        <div id="assets-tabs">
+          <h2 class="pt-3" id="assets">Targeted Assets</h2>
+          <table class="table table-bordered table-alternate mt-2" aria-describedby="asset-table">
+            <thead>
+              <tr>
+                <th scope="col">ID</th>
+                <th scope="col">Asset</th>
+              </tr>
+            </thead>
+            <tbody>
+            {% for asset in parsed.assets %}
+              <tr>
+                <td>
+                  <a href="/assets/{{asset.id}}"> {{asset.id}} </a>
+                </td>
+                <td>
+                  <a href="/assets/{{asset.id}}"> {{asset.asset}} </a>
+                </td>
+              </tr>
+            {% endfor %}
+            </tbody>
+          </table>
+        </div>
+        {% endif %}
+
         {{ citations.reference_section(parsed.citations) }}
         {% endif %}
       </div>

modules/matrices/matrices.py

@@ -61,7 +61,8 @@ def generate_platform_matrices(matrix, notes, side_menu_data=None):
             data["notes"].append(notes.get(matrix_id))
 
     data["platforms"] = [
-        {"name": platform, "path": matrices_config.platform_to_path[platform]} for platform in matrix["platforms"]
+        {"name": platform, "path": matrices_config.platform_to_path[matrix["matrix"]][platform]}
+        for platform in matrix["platforms"]
     ]
     data["navigator_link"] = site_config.navigator_link
 
@@ -139,7 +140,8 @@ def get_sub_matrices(matrix):
     domain_ms = ms[matrix["matrix"]]
     # get relevant techniques
     techniques = util.stixhelpers.get_techniques(domain_ms, matrix["matrix"])
-    platform_techniques = util.buildhelpers.filter_techniques_by_platform(techniques, matrix["platforms"])
+    filter_platforms = matrix.get("filter_platforms", matrix["platforms"])
+    platform_techniques = util.buildhelpers.filter_techniques_by_platform(techniques, filter_platforms)
     platform_techniques = util.buildhelpers.filter_out_subtechniques(platform_techniques)
     platform_techniques = util.buildhelpers.filter_deprecated_revoked(platform_techniques)
     # get relevant tactics
@@ -194,7 +196,7 @@ def transform_technique(technique, tactic_id):
                 obj["subtechniques"] = list(filter(lambda st: len(st) > 0, obj["subtechniques"]))
                 # Filter subtechniques by platform
                 obj["subtechniques"] = util.buildhelpers.filter_techniques_by_platform(
-                    obj["subtechniques"], matrix["platforms"]
+                    obj["subtechniques"], filter_platforms
                 )
                 # remove deprecated and revoked
                 obj["subtechniques"] = util.buildhelpers.filter_deprecated_revoked(obj["subtechniques"])
@@ -224,9 +226,7 @@ def techniques_in_tactic(tactic_id):
             logger.warning(f"Tactic not found or missing shortname: {tactic_id}")
             return []
         # filter platform techniques to those inside of this tactic
-        techniques = list(
-            filter(lambda technique: shortname in phase_names(technique), platform_techniques)
-        )
+        techniques = list(filter(lambda technique: shortname in phase_names(technique), platform_techniques))
         # transform into format required by matrix macro
         return list(map(lambda t: transform_technique(t, tactic_id), techniques))
 

modules/matrices/matrices_config.py

@@ -209,9 +209,48 @@
         "type": "local",
         "path": "ics",
         "matrix": "ics-attack",
-        "platforms": [],
+        "platforms": ["Embedded", "Windows", "Linux", "Network Devices"],
+        # Keep platform links while showing all ICS techniques in the domain matrix.
+        "filter_platforms": [],
         "descr": "Below are the tactics and techniques representing the MITRE ATT&CK<sup>&reg;</sup> Matrix for ICS.",
-        "subtypes": [],
+        "subtypes": [
+            {
+                "name": "Embedded",
+                "type": "local",
+                "matrix": "ics-attack",
+                "path": "ics/embedded",
+                "platforms": ["Embedded"],
+                "descr": "Below are the tactics and techniques representing the MITRE ATT&CK<sup>&reg;</sup> Embedded platform for ICS.",
+                "subtypes": [],
+            },
+            {
+                "name": "Windows",
+                "type": "local",
+                "matrix": "ics-attack",
+                "path": "ics/windows",
+                "platforms": ["Windows"],
+                "descr": "Below are the tactics and techniques representing the MITRE ATT&CK<sup>&reg;</sup> Windows platform for ICS.",
+                "subtypes": [],
+            },
+            {
+                "name": "Linux",
+                "type": "local",
+                "matrix": "ics-attack",
+                "path": "ics/linux",
+                "platforms": ["Linux"],
+                "descr": "Below are the tactics and techniques representing the MITRE ATT&CK<sup>&reg;</sup> Linux platform for ICS.",
+                "subtypes": [],
+            },
+            {
+                "name": "Network Devices",
+                "type": "local",
+                "matrix": "ics-attack",
+                "path": "ics/network-devices",
+                "platforms": ["Network Devices"],
+                "descr": "Below are the tactics and techniques representing the MITRE ATT&CK<sup>&reg;</sup> Network Devices platform for ICS.",
+                "subtypes": [],
+            },
+        ],
     },
 ]
 
@@ -224,17 +263,27 @@
 ]
 
 platform_to_path = {
-    "PRE": "enterprise/pre",
-    "Windows": "enterprise/windows",
-    "macOS": "enterprise/macos",
-    "Linux": "enterprise/linux",
-    "Office Suite": "enterprise/cloud/officesuite",
-    "Identity Provider": "enterprise/cloud/identityprovider",
-    "SaaS": "enterprise/cloud/saas",
-    "IaaS": "enterprise/cloud/iaas",
-    "Network Devices": "enterprise/network-devices",
-    "Containers": "enterprise/containers",
-    "ESXi": "enterprise/esxi",
-    "Android": "mobile/android",
-    "iOS": "mobile/ios",
+    "enterprise-attack": {
+        "PRE": "enterprise/pre",
+        "Windows": "enterprise/windows",
+        "macOS": "enterprise/macos",
+        "Linux": "enterprise/linux",
+        "Office Suite": "enterprise/cloud/officesuite",
+        "Identity Provider": "enterprise/cloud/identityprovider",
+        "SaaS": "enterprise/cloud/saas",
+        "IaaS": "enterprise/cloud/iaas",
+        "Network Devices": "enterprise/network-devices",
+        "Containers": "enterprise/containers",
+        "ESXi": "enterprise/esxi",
+    },
+    "mobile-attack": {
+        "Android": "mobile/android",
+        "iOS": "mobile/ios",
+    },
+    "ics-attack": {
+        "Embedded": "ics/embedded",
+        "Windows": "ics/windows",
+        "Linux": "ics/linux",
+        "Network Devices": "ics/network-devices",
+    },
 }