DeTTECT/mitre-data/subtechniques-crosswalk.json

[
    {
        "T1001": [
            {
                "id": "T1001",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1002": [
            {
                "id": "T1560",
                "explanation": "Created to consolidate behavior around encrypting and compressing collected data"
            }
        ],
        "change-type": "One or More Techniques Became New Technique"
    },
    {
        "T1003": [
            {
                "id": "T1003",
                "explanation": "Renamed, Name change from Credential Dumping and new sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1004": [
            {
                "id": "T1547.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1005": [
            {
                "id": "T1005",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1006": [
            {
                "id": "T1006",
                "explanation": "Renamed, Name change from File System Logical Offsets"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1007": [
            {
                "id": "T1007",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1008": [
            {
                "id": "T1008",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1009": [
            {
                "id": "T1027.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1010": [
            {
                "id": "T1010",
                "explanation": "Fixed technique reference in description"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1011": [
            {
                "id": "T1011",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1012": [
            {
                "id": "T1012",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1013": [
            {
                "id": "T1547.010",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1014": [
            {
                "id": "T1014",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1015": [
            {
                "id": "T1546.008",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1016": [
            {
                "id": "T1016",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1017": [
            {
                "id": "T1072",
                "explanation": "Name change from Application Deployment Software"
            }
        ],
        "change-type": "Merged into Existing Technique"
    },
    {
        "T1018": [
            {
                "id": "T1018",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1019": [
            {
                "id": "T1542.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1020": [
            {
                "id": "T1020",
                "explanation": "Fixed technique reference in description"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1021": [
            {
                "id": "T1021",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1022": [
            {
                "id": "T1560",
                "explanation": "Created to consolidate behavior around encrypting and compressing collected data"
            }
        ],
        "change-type": "One or More Techniques Became New Technique"
    },
    {
        "T1023": [
            {
                "id": "T1547.009",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1024": [
            {
                "id": "T1573",
                "explanation": "Created to consolidate behavior around encrypted C2"
            }
        ],
        "change-type": "One or More Techniques Became New Technique"
    },
    {
        "T1025": [
            {
                "id": "T1025",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1026": [
            {
                "id": "N/A",
                "explanation": "Deprecated from ATT&CK due to lack of in the wild use. Existing Group/Software procedure examples did not fit the core idea behind the technique"
            }
        ],
        "change-type": "Deprecated"
    },
    {
        "T1027": [
            {
                "id": "T1027",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1028": [
            {
                "id": "T1021.006",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1029": [
            {
                "id": "T1029",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1030": [
            {
                "id": "T1030",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1031": [
            {
                "id": "T1543.003",
                "explanation": "Existing technique that became a sub-technique. Consolidates Modify Existing Service and New Service techniques into one sub-technique"
            }
        ],
        "change-type": "Multiple Techniques Became New Sub-Technique"
    },
    {
        "T1032": [
            {
                "id": "T1573",
                "explanation": "Created to consolidate behavior around encrypted C2"
            }
        ],
        "change-type": "One or More Techniques Became New Technique"
    },
    {
        "T1033": [
            {
                "id": "T1033",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1034": [
            {
                "id": "T1574.007",
                "explanation": "Deprecated and split into separate Unquoted Path, PATH Environment Variable, and Search Order Hijacking sub-techniques."
            },
            {
                "id": "T1574.008",
                "explanation": "Deprecated and split into separate Unquoted Path, PATH Environment Variable, and Search Order Hijacking sub-techniques."
            },
            {
                "id": "T1574.009",
                "explanation": "Deprecated and split into separate Unquoted Path, PATH Environment Variable, and Search Order Hijacking sub-techniques."
            }
        ],
        "change-type": "Became Multiple Sub-Techniques"
    },
    {
        "T1035": [
            {
                "id": "T1569.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1036": [
            {
                "id": "T1036",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1037": [
            {
                "id": "T1037",
                "explanation": "Remove from lateral-movement, Renamed, Name change from Logon Scripts and new sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1038": [
            {
                "id": "T1574.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1039": [
            {
                "id": "T1039",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1040": [
            {
                "id": "T1040",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1041": [
            {
                "id": "T1041",
                "explanation": "Renamed, Name change from Exfiltration over Command and Control Channel and added data sources"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1042": [
            {
                "id": "T1546.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1043": [
            {
                "id": "N/A",
                "explanation": "Deprecated from ATT&CK because the behavior is redundant and describes most benign network communications."
            }
        ],
        "change-type": "Deprecated"
    },
    {
        "T1044": [
            {
                "id": "T1574.010",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1045": [
            {
                "id": "T1027.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1046": [
            {
                "id": "T1046",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1047": [
            {
                "id": "T1047",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1048": [
            {
                "id": "T1048",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1049": [
            {
                "id": "T1049",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1050": [
            {
                "id": "T1543.003",
                "explanation": "Existing technique that became a sub-technique. Consolidates Modify Existing Service and New Service techniques into one sub-technique"
            }
        ],
        "change-type": "Multiple Techniques Became New Sub-Technique"
    },
    {
        "T1051": [
            {
                "id": "N/A",
                "explanation": "Deprecated from ATT&CK due to lack of in the wild use"
            }
        ],
        "change-type": "Deprecated"
    },
    {
        "T1052": [
            {
                "id": "T1052",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1053": [
            {
                "id": "T1053",
                "explanation": "Renamed, Name change from Local Job Scheduling and new sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1054": [
            {
                "id": "T1562.006",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1055": [
            {
                "id": "T1055",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1056": [
            {
                "id": "T1056",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1057": [
            {
                "id": "T1057",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1058": [
            {
                "id": "T1574.011",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1059": [
            {
                "id": "T1059",
                "explanation": "Renamed, Name change from Command-Line Interface and new sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1060": [
            {
                "id": "T1547.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1061": [
            {
                "id": "N/A",
                "explanation": "Deprecated from ATT&CK because the behavior is redundant and implied by use of remote desktop tools like Remote Desktop Protocol. Existing Group/Software procedure examples were remapped appropriately"
            }
        ],
        "change-type": "Deprecated"
    },
    {
        "T1062": [
            {
                "id": "N/A",
                "explanation": "Deprecated from ATT&CK due to lack of in the wild use"
            }
        ],
        "change-type": "Deprecated"
    },
    {
        "T1063": [
            {
                "id": "T1518.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1064": [
            {
                "id": "T1059.004",
                "explanation": "Deprecated and split into separate Unix Shell, Visual Basic, JavaScript/Jscript, and Python sub-techniques of Command and Scripting Interpreter."
            },
            {
                "id": "T1059.005",
                "explanation": "Deprecated and split into separate Unix Shell, Visual Basic, JavaScript/Jscript, and Python sub-techniques of Command and Scripting Interpreter."
            },
            {
                "id": "T1059.006",
                "explanation": "Deprecated and split into separate Unix Shell, Visual Basic, JavaScript/Jscript, and Python sub-techniques of Command and Scripting Interpreter."
            },
            {
                "id": "T1059.007",
                "explanation": "Deprecated and split into separate Unix Shell, Visual Basic, JavaScript/Jscript, and Python sub-techniques of Command and Scripting Interpreter."
            }
        ],
        "change-type": "Became Multiple Sub-Techniques"
    },
    {
        "T1065": [
            {
                "id": "T1571",
                "explanation": "Created to refine the idea behind Common and Uncommonly Used Port to focus the behavior on use of a non-standard port for C2 based on the protocol used"
            }
        ],
        "change-type": "One or More Techniques Became New Technique"
    },
    {
        "T1066": [
            {
                "id": "T1027.005",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1067": [
            {
                "id": "T1542.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1068": [
            {
                "id": "T1068",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1069": [
            {
                "id": "T1069",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1070": [
            {
                "id": "T1070",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1071": [
            {
                "id": "T1071",
                "explanation": "Renamed, Name change from Standard Application Layer Protocol and new sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1072": [
            {
                "id": "T1072",
                "explanation": "Renamed, Name change from Application Deployment Software"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1073": [
            {
                "id": "T1574.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1074": [
            {
                "id": "T1074",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1075": [
            {
                "id": "T1550.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1076": [
            {
                "id": "T1021.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1077": [
            {
                "id": "T1021.002",
                "explanation": "Existing technique that became a sub-technique and was renamed from Windows Admin Shares"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1078": [
            {
                "id": "T1078",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1079": [
            {
                "id": "T1573",
                "explanation": "Created to consolidate behavior around encrypted C2"
            }
        ],
        "change-type": "One or More Techniques Became New Technique"
    },
    {
        "T1080": [
            {
                "id": "T1080",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1081": [
            {
                "id": "T1552.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1082": [
            {
                "id": "T1082",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1083": [
            {
                "id": "T1083",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1084": [
            {
                "id": "T1546.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1085": [
            {
                "id": "T1218.011",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1086": [
            {
                "id": "T1059.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1087": [
            {
                "id": "T1087",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1088": [
            {
                "id": "T1548.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1089": [
            {
                "id": "T1562.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1090": [
            {
                "id": "T1090",
                "explanation": "Renamed, Name change from Connection Proxy and new sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1091": [
            {
                "id": "T1091",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1092": [
            {
                "id": "T1092",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1093": [
            {
                "id": "T1055.012",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1094": [
            {
                "id": "T1095",
                "explanation": "Merged with and name change from Standard Non-Application Layer Protocol"
            }
        ],
        "change-type": "Merged into Existing Technique"
    },
    {
        "T1095": [
            {
                "id": "T1095",
                "explanation": "Renamed, Name change from Standard Non-Application Layer Protocol"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1096": [
            {
                "id": "T1564.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1097": [
            {
                "id": "T1550.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1098": [
            {
                "id": "T1098",
                "explanation": "Remove from credential-access, New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1099": [
            {
                "id": "T1070.006",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1100": [
            {
                "id": "T1505.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1101": [
            {
                "id": "T1547.005",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1102": [
            {
                "id": "T1102",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1103": [
            {
                "id": "T1546.010",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1104": [
            {
                "id": "T1104",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1105": [
            {
                "id": "T1105",
                "explanation": "Renamed, Name change from Remote File Copy"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1106": [
            {
                "id": "T1106",
                "explanation": "Renamed, Name change from Execution through API"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1107": [
            {
                "id": "T1070.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1108": [
            {
                "id": "N/A",
                "explanation": "Deprecated from ATT&CK because the behavior is too high level and is sufficiently covered by Valid Accounts and External Remote Services. Existing Group/Software procedure examples were remapped appropriately"
            }
        ],
        "change-type": "Deprecated"
    },
    {
        "T1109": [
            {
                "id": "T1542.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1110": [
            {
                "id": "T1110",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1111": [
            {
                "id": "T1111",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1112": [
            {
                "id": "T1112",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1113": [
            {
                "id": "T1113",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1114": [
            {
                "id": "T1114",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1115": [
            {
                "id": "T1115",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1116": [
            {
                "id": "T1553.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1117": [
            {
                "id": "T1218.010",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1118": [
            {
                "id": "T1218.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1119": [
            {
                "id": "T1119",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1120": [
            {
                "id": "T1120",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1121": [
            {
                "id": "T1218.009",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1122": [
            {
                "id": "T1546.015",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1123": [
            {
                "id": "T1123",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1124": [
            {
                "id": "T1124",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1125": [
            {
                "id": "T1125",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1126": [
            {
                "id": "T1070.005",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1127": [
            {
                "id": "T1127",
                "explanation": "Renamed, Minor description update, sub-technique added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1128": [
            {
                "id": "T1546.007",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1129": [
            {
                "id": "T1129",
                "explanation": "Renamed, Name change from Execution through Module Load"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1130": [
            {
                "id": "T1553.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1131": [
            {
                "id": "T1547.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1132": [
            {
                "id": "T1132",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1133": [
            {
                "id": "T1133",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1134": [
            {
                "id": "T1134",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1135": [
            {
                "id": "T1135",
                "explanation": "Fixed technique reference in description, added Linux, and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1136": [
            {
                "id": "T1136",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1137": [
            {
                "id": "T1137",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1138": [
            {
                "id": "T1546.011",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1139": [
            {
                "id": "T1552.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1140": [
            {
                "id": "T1140",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1141": [
            {
                "id": "T1056.002",
                "explanation": "Broken out from pre-defined behavior within Input Capture"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1142": [
            {
                "id": "T1555.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1143": [
            {
                "id": "T1564.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1144": [
            {
                "id": "T1553.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1145": [
            {
                "id": "T1552.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1146": [
            {
                "id": "T1070.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1147": [
            {
                "id": "T1564.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1148": [
            {
                "id": "T1562.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1149": [
            {
                "id": "N/A",
                "explanation": "Deprecated from ATT&CK due to lack of in the wild use"
            }
        ],
        "change-type": "Deprecated"
    },
    {
        "T1150": [
            {
                "id": "T1547.011",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Multiple Techniques Became New Sub-Technique"
    },
    {
        "T1151": [
            {
                "id": "T1036.006",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1152": [
            {
                "id": "T1569.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1153": [
            {
                "id": "N/A",
                "explanation": "Deprecated from ATT&CK due to lack of in the wild use"
            }
        ],
        "change-type": "Deprecated"
    },
    {
        "T1154": [
            {
                "id": "T1546.005",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1155": [
            {
                "id": "T1059.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1156": [
            {
                "id": "T1546.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1157": [
            {
                "id": "T1574.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1158": [
            {
                "id": "T1564.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1159": [
            {
                "id": "T1543.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1160": [
            {
                "id": "T1543.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1161": [
            {
                "id": "T1546.006",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1162": [
            {
                "id": "T1547.011",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Multiple Techniques Became New Sub-Technique"
    },
    {
        "T1163": [
            {
                "id": "T1037.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1164": [
            {
                "id": "T1547.007",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1165": [
            {
                "id": "T1037.005",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1166": [
            {
                "id": "T1548.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1167": [
            {
                "id": "T1555.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1168": [
            {
                "id": "T1053",
                "explanation": "Name change from Local Job Scheduling and new sub-techniques added"
            }
        ],
        "change-type": "Merged into Existing Technique"
    },
    {
        "T1169": [
            {
                "id": "T1548.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Multiple Techniques Became New Sub-Technique"
    },
    {
        "T1170": [
            {
                "id": "T1218.005",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1171": [
            {
                "id": "T1557.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1172": [
            {
                "id": "T1090.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1173": [
            {
                "id": "T1559.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1174": [
            {
                "id": "T1556.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1175": [
            {
                "id": "T1021.003",
                "explanation": "Deprecated and split into separate Component Object Model and Distributed Component Object Model sub-techniques."
            },
            {
                "id": "T1559.001",
                "explanation": "Deprecated and split into separate Component Object Model and Distributed Component Object Model sub-techniques."
            }
        ],
        "change-type": "Became Multiple Sub-Techniques"
    },
    {
        "T1176": [
            {
                "id": "T1176",
                "explanation": "Data sources changed and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1177": [
            {
                "id": "T1547.008",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1178": [
            {
                "id": "T1134.005",
                "explanation": "Added due to manipulation of token information"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1179": [
            {
                "id": "T1056.004",
                "explanation": "Existing technique that became a sub-technique and was renamed from API Hooking. Scope change to only credential access for API hooking was based on available procedure examples"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1180": [
            {
                "id": "T1546.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1181": [
            {
                "id": "T1055.011",
                "explanation": "Broken out from pre-defined behavior within Process Injection"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1182": [
            {
                "id": "T1546.009",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1183": [
            {
                "id": "T1546.012",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1184": [
            {
                "id": "T1563.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1185": [
            {
                "id": "T1185",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1186": [
            {
                "id": "T1055.013",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1187": [
            {
                "id": "T1187",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1188": [
            {
                "id": "T1090.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1189": [
            {
                "id": "T1189",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1190": [
            {
                "id": "T1190",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1191": [
            {
                "id": "T1218.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1192": [
            {
                "id": "T1566.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1193": [
            {
                "id": "T1566.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1194": [
            {
                "id": "T1566.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1195": [
            {
                "id": "T1195",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1196": [
            {
                "id": "T1218.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1197": [
            {
                "id": "T1197",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1198": [
            {
                "id": "T1553.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1199": [
            {
                "id": "T1199",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1200": [
            {
                "id": "T1200",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1201": [
            {
                "id": "T1201",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1202": [
            {
                "id": "T1202",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1203": [
            {
                "id": "T1203",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1204": [
            {
                "id": "T1204",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1205": [
            {
                "id": "T1205",
                "explanation": "Renamed, Technique renamed and sub-technique added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1206": [
            {
                "id": "T1548.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Multiple Techniques Became New Sub-Technique"
    },
    {
        "T1207": [
            {
                "id": "T1207",
                "explanation": "Renamed, Name change from DCShadow"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1208": [
            {
                "id": "T1558.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1209": [
            {
                "id": "T1547.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1210": [
            {
                "id": "T1210",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1211": [
            {
                "id": "T1211",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1212": [
            {
                "id": "T1212",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1213": [
            {
                "id": "T1213",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1214": [
            {
                "id": "T1552.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1215": [
            {
                "id": "T1547.006",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1216": [
            {
                "id": "T1216",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1217": [
            {
                "id": "T1217",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1218": [
            {
                "id": "T1218",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1219": [
            {
                "id": "T1219",
                "explanation": "Renamed, Name change from Remote Access Tools and fixed technique reference in description"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1220": [
            {
                "id": "T1220",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1221": [
            {
                "id": "T1221",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1222": [
            {
                "id": "T1222",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1223": [
            {
                "id": "T1218.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1480": [
            {
                "id": "T1480",
                "explanation": "New sub-technique added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1482": [
            {
                "id": "T1482",
                "explanation": "Fixed technique reference in description and minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1483": [
            {
                "id": "T1568.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1484": [
            {
                "id": "T1484",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1485": [
            {
                "id": "T1485",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1486": [
            {
                "id": "T1486",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1487": [
            {
                "id": "T1561.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1488": [
            {
                "id": "T1561.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1489": [
            {
                "id": "T1489",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1490": [
            {
                "id": "T1490",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1491": [
            {
                "id": "T1491",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1492": [
            {
                "id": "T1565.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1493": [
            {
                "id": "T1565.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1494": [
            {
                "id": "T1565.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1495": [
            {
                "id": "T1495",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1496": [
            {
                "id": "T1496",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1497": [
            {
                "id": "T1497",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1498": [
            {
                "id": "T1498",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1499": [
            {
                "id": "T1499",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1500": [
            {
                "id": "T1027.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1501": [
            {
                "id": "T1543.002",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1502": [
            {
                "id": "T1134.004",
                "explanation": "Added due to manipulation of tokens"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1503": [
            {
                "id": "T1555.003",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1504": [
            {
                "id": "T1546.013",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1505": [
            {
                "id": "T1505",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1506": [
            {
                "id": "T1550.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1514": [
            {
                "id": "T1548.004",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1518": [
            {
                "id": "T1518",
                "explanation": "New sub-techniques added"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1519": [
            {
                "id": "T1546.014",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1522": [
            {
                "id": "T1552.005",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1525": [
            {
                "id": "T1525",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1526": [
            {
                "id": "T1526",
                "explanation": "Minor description update"
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1527": [
            {
                "id": "T1550.001",
                "explanation": "Existing technique that became a sub-technique"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1528": [
            {
                "id": "T1528",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1529": [
            {
                "id": "T1529",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1530": [
            {
                "id": "T1530",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1531": [
            {
                "id": "T1531",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1534": [
            {
                "id": "T1534",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1535": [
            {
                "id": "T1535",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1536": [
            {
                "id": "T1578.004",
                "explanation": "Created as distinct behavior within Modify Cloud Compute Infrastructure"
            }
        ],
        "change-type": "Became a Sub-Technique"
    },
    {
        "T1537": [
            {
                "id": "T1537",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1538": [
            {
                "id": "T1538",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    },
    {
        "T1539": [
            {
                "id": "T1539",
                "explanation": ""
            }
        ],
        "change-type": "Remains Technique"
    }
]