patch&proof.
← The dispatch

defense-research / Archive analysis

MITRE ATT&CK v8 joined pre-compromise behavior to the enterprise model

The October 2020 release added reconnaissance and resource-development tactics while retiring PRE-ATT&CK.

Historical backfill · prepared 16 September 2026. Dates below describe the source or event; this is a local review edition.

Development brief

MITRE's version history dates ATT&CK v8 to October 27, 2020. The release retired the separate PRE-ATT&CK domain and brought reconnaissance and resource development into Enterprise ATT&CK as tactics. It also added a Network platform and updated techniques, groups and software. The release is a change to a public knowledge base of observed adversary behavior, not a newly observed campaign. The version date is genuine; the page's original publication date is not separately established in this record.

Why the model changed

A defender who looked only at actions after an attacker entered a network could miss useful context about preparation. Moving early behavior into the enterprise model made it easier to describe a connected sequence, while keeping tactical labels consistent across phases. Yet a matrix is a classification aid, not a guarantee of visibility. The presence of a technique in a dataset does not mean a particular organization can detect it, and the absence of a behavior from the dataset does not make it impossible. MITRE itself warns against treating the matrix as a completed checklist or claiming universal coverage.

Defensive reading

Use an ATT&CK version when recording an investigation, because technique names and structure can change. Map observations to behaviors with evidence: logs, alerts, host findings or a tested analytic. Distinguish a product's advertised coverage from a detection that has fired in a realistic exercise. Prioritize techniques relevant to the services and threats at hand, then document gaps in telemetry and response. A map is most useful when it leads to a concrete test or an improved collection plan, not a colored board with no owner.

What remains bounded

This is a standards-and-research development, not a breach report. Counts or classifications from v8 should not be projected onto later versions without checking change records. Nor does a technique label establish actor attribution. The lasting benefit is a shared language for defensive evidence, provided teams retain the version, platform and underlying observation that justify each mapping.

Evidence & dates

Follow the source.

MITRE records v8 release 2020-10-27; exact publication dates of the current web pages are unverified, so source_published_at remains null.

Source published
See individual source / original research
Event date
2020-10-27
Site publication
Unpublished · local review
ATT&CK Updates — October 2020Get Started with ATT&CK
Make it useful

Turn the reading into a decision.

Open the interactive lab ↗
Search the evidence
Source image / inspection view

View original source ↗Local review · rights and provenance pending owner approval