[Bug] Update MITRE ATT&CK technique references

[eric-forte-elastic]

Summary

Updates deprecated and revoked MITRE ATT&CK technique IDs across the repo so RTA metadata and comments align with current ATT&CK (v17+).

Changes

• Comments: Replaced deprecated # ATT&CK: technique IDs with current equivalents (e.g. T1022 → T1560, T1088 → T1548.002, T1140 → T1027/T1059.001, T1064/T1192/T1193 → T1566). Where there is no single replacement, comments now note the ID is deprecated and point to relevant techniques.
• Techniques lists: Removed deprecated T1140 (Deobfuscate/Decode) from all techniques= arrays and used T1027 (Obfuscated Files or Information) and/or T1059.001 (PowerShell) as appropriate. T1574.002 (DLL Side-Loading, revoked in v17) was already replaced with T1574.001 in a prior change.

Reference

• MITRE ATT&CK updates

Deprecated Post 2018

Deprecated Techniques (No Replacement)

These techniques were deprecated (no longer in use, not replaced by another object). When a replacement is commonly used in practice, it is noted.

ID	Name	Domain	Deprecated In	Notes / Common Replacement
T1053.004	(Scheduled Task variant)	Enterprise	v10 (Oct 2021)	Deprecated to better reflect adversary behavior; see October 2021 release. Use other T1053 sub-techniques as appropriate.
T1064	Scripting	Enterprise	Later release	Deprecated; use T1059 (Command and Scripting Interpreter) and sub-techniques.
(Others)	—	—	—	Full list: see “Object deprecations” in the detailed changelog for each version (e.g. changelog v16.1→v17.0, changelog v11.2→v11.3).

Other commonly referenced deprecated/revoked technique IDs

The following IDs are frequently cited in legacy content or rule sets as deprecated or superseded. The exact version and replacement (if any) are in the official changelogs; this table is a quick reference.

Old ID	Typical replacement(s)	Context
T1015	T1546.008 (Accessibility Features)	Accessibility Features → Event Triggered Execution
T1022	T1560 (Data Encrypted for Impact)	Data Encrypted
T1023	T1547.009 (Shortcut Modification)	Persistence via shortcuts
T1035	T1021 (Remote Services), T1484 (Group Policy)	Lateral movement / policy
T1042	T1546.001 (Change Default File Association)	Event Triggered Execution
T1044	(varies)	LFH Allocator; scope changed/deprecated
T1061	T1546 (event-driven execution)	Graphical User Interface
T1076	T1021 (Remote Services)	Remote Desktop / remote services
T1077	T1021, T1484	Lateral movement
T1086	T1059.001 (PowerShell)	PowerShell as scripting
T1088	T1548.002 (Bypass User Account Control)	UAC bypass
T1103	T1547 (Boot/Logon Autostart)	Persistence
T1107	T1070 (Indicator Removal) and sub-techniques	File Deletion
T1116	T1553 (Subvert Trust Controls), T1553.002 (Code Signing)	Code Signing
T1117	T1218.010 (Regsvr32), T1546	Regsvr32 / COM
T1118	T1218.004 (InstallUtil)	InstallUtil
T1122	T1546.015 (Component Object Model Hijacking)	COM Hijacking
T1138	T1546.011 (Application Shimming)	Application Shimming
T1140	T1027 (Obfuscated Files or Information), T1059.*	Deobfuscate/Decode
T1158	(varies)	Hidden Credentials; check current credential techniques
T1170	T1021 (Remote Services)	Mshta and remote services
T1183	T1546.012 (Image File Execution Options Injection)	IFEO
T1192	T1566 (Phishing), T1566.001/.002	Spearphishing Attachment/Link
T1193	T1566 (Phishing)	Spearphishing
T1222	T1222 (File Permissions Modification) – now has sub-techniques	Renamed/refined
T1223	T1218.001 (Compiled HTML File)	CHM

---

Revoked Techniques (Replaced By Another Object)

These techniques were revoked and replaced by another technique or sub-technique.

Enterprise

Old ID	Old Name	Replaced By	Revoked In	Notes
T1574.002	Hijack Execution Flow: DLL Side-Loading	T1574.001 (Hijack Execution Flow: DLL)	v17 (Apr 2025)	Merged into T1574.001; T1574.001 was renamed from “DLL Search Order Hijacking.” April 2025 release.

July 2020 (v7) revocations: Dozens of former standalone techniques were revoked and folded into sub-techniques. Examples (from the July 2020 release):

• “Accessibility Features” → T1546.008 (Event Triggered Execution: Accessibility Features)
• “Bypass User Access Control” → T1548.002 (Abuse Elevation Control Mechanism: Bypass User Account Control)
• “DLL Side-Loading” → T1574.002 (later itself revoked in v17 → T1574.001)
• “DLL Search Order Hijacking” → T1574.001
• “Registry Run Keys / Startup Folder” → T1547.001
• “Image File Execution Options Injection” → T1546.012
• “Application Shimming” → T1546.011
• “Code Signing” → T1553.002
• “Gatekeeper Bypass” → T1553.001
• And many more under T1546, T1547, T1548, T1553, T1556, T1562, T1574, etc.

The complete list of v6→v7 revocations is in the machine-readable changelog (e.g. changelog.json for the v6.3–v7.0 or v7.2–v8.0 transition, under “revoked_by” or equivalent).

Mobile

Old ID	Old Name	Status	Notes
T1453	Abuse Accessibility Features	Un-deprecated in v18 (Oct 2025)	Was deprecated (last in v6); restored in October 2025 release.

Other Mobile technique revocations/deprecations are in the Mobile-specific changelogs (e.g. v11.2→v11.3, v13.1→v14.0).

---

Deprecated Tactics

Since 2018, tactics have been given TA#### IDs and reorganized (e.g. PRE-ATT&CK merged into Enterprise, Mobile “Obtain Device Access” folded into Initial Access). There is no single “deprecated tactic” list in the same way as techniques; old tactic names/structures were superseded by the current matrix.

• PRE-ATT&CK tactics were folded into the Enterprise model; PRE-ATT&CK as a separate matrix was retired.
• Mobile: “Obtain Device Access” was collapsed into Initial Access; “Network-Based Effects” was split into “Network Effects” and “Remote Service Effects” (see October 2018).

For exact tactic renames or structural changes, check the release notes and changelogs for the relevant version.

---

How to Get the Complete List

1. Changelog index: attack.mitre.org/resources/updates
   Each release links to:

   • Human-readable changelog-detailed.html
   • Machine-readable changelog.json

2. Detailed changelogs (examples):

   • v16.1 → v17.0 (includes T1574.002 revocation)
   • v15.1 → v16.0
   • v13.1 → v14.0
   • v11.2 → v11.3
   • v7.2 → v8.0

3. JSON changelogs (for scripts and full deprecation/revocation lists):

   • e.g. https://attack.mitre.org/docs/changelogs/v16.1-v17.0/changelog.json
   • Format described: mitreattack-python diffStix README

4. Versioned ATT&CK: attack.mitre.org/versions
   Links to preserved versions (e.g. v6 pre–sub-techniques, v17, v18).

---

Summary Table (Deprecated / Revoked Since 2018)

Type	Domain	Count / Scope	Where to Find Full List
Revoked (replaced)	Enterprise	Many (v7 restructure) + T1574.002 in v17	v6.3→v7.0 and v7.2→v8.0 changelogs; v16.1→v17.0 for T1574.002
Deprecated (no replacement)	Enterprise	T1053.004, T1064, others	Per-version detailed changelogs (“Object deprecations”)
Revoked / Deprecated	Mobile	Various; T1453 un-deprecated in v18	Mobile sections of changelogs; Oct 2025 release
Tactics	All	Structural renames/merges (PRE-ATT&CK, Mobile)	Oct 2018, July 2020, and version-specific release notes