)

## Summary

Addresses: elastic#166152 for `9.3.0`

Updates MITRE ATT&CK mappings to
[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).
Last update was to `v17.1` in
elastic#231375.

To update,  I modified

https://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v18.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/docs-content#4395

## Test Criteria

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

(cherry picked from commit 6b6a30e)

)

## Summary

Addresses: elastic#166152 for `9.3.0`

Updates MITRE ATT&CK mappings to
[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).
Last update was to `v17.1` in
elastic#231375.

To update,  I modified

https://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v18.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/docs-content#4395

## Test Criteria

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

(cherry picked from commit 6b6a30e)

)

## Summary

Addresses: elastic#166152 for `9.3.0`

Updates MITRE ATT&CK mappings to
[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).
Last update was to `v17.1` in
elastic#231375.

To update,  I modified 


https://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v18.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.


## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/docs-content#4395

## Test Criteria

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

)

## Summary

Addresses: elastic#166152 for `9.3.0`

Updates MITRE ATT&CK mappings to
[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).
Last update was to `v17.1` in
elastic#231375.

To update,  I modified

https://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v18.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/docs-content#4395

## Test Criteria

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

(cherry picked from commit 6b6a30e)

# Conflicts:
#	x-pack/platform/plugins/private/translations/translations/de-DE.json

)

## Summary

Addresses: elastic#166152 for `9.3.0`

Updates MITRE ATT&CK mappings to
[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).
Last update was to `v17.1` in
elastic#231375.

To update,  I modified

https://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v18.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/docs-content#4395

## Test Criteria

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

(cherry picked from commit 6b6a30e)

# Conflicts:
#	x-pack/platform/plugins/private/translations/translations/de-DE.json
#	x-pack/platform/plugins/private/translations/translations/fr-FR.json
#	x-pack/platform/plugins/private/translations/translations/zh-CN.json

…) (#247299)

# Backport

This will backport the following commits from `main` to `9.1`:
- [[Security Solution] Updates kibana MITRE data to `v18.1`
(#246770)](#246770)

<!--- Backport version: 10.2.0 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-12-19T16:42:41Z","message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","backport:version","Feature:Rule MITRE
ATT&CK®","v9.3.0","v9.4.0","v9.2.4","v9.1.10","v8.19.10"],"title":"[Security
Solution] Updates kibana MITRE data to
`v18.1`","number":246770,"url":"https://github.com/elastic/kibana/pull/246770","mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"9.3","label":"v9.3.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/247154","number":247154,"state":"OPEN"},{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/246770","number":246770,"mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249"}},{"branch":"9.2","label":"v9.2.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/247153","number":247153,"state":"OPEN"},{"branch":"9.1","label":"v9.1.10","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.10","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

) (#247300)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Updates kibana MITRE data to `v18.1`
(#246770)](#246770)

<!--- Backport version: 10.2.0 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-12-19T16:42:41Z","message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","backport:version","Feature:Rule MITRE
ATT&CK®","v9.3.0","v9.4.0","v9.2.4","v9.1.10","v8.19.10"],"title":"[Security
Solution] Updates kibana MITRE data to
`v18.1`","number":246770,"url":"https://github.com/elastic/kibana/pull/246770","mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19"],"targetPullRequestStates":[{"branch":"9.3","label":"v9.3.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/247154","number":247154,"state":"OPEN"},{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/246770","number":246770,"mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249"}},{"branch":"9.2","label":"v9.2.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"url":"https://github.com/elastic/kibana/pull/247153","number":247153,"state":"OPEN"},{"branch":"9.1","label":"v9.1.10","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.10","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

…) (#247153)

# Backport

This will backport the following commits from `main` to `9.2`:
- [[Security Solution] Updates kibana MITRE data to `v18.1`
(#246770)](#246770)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-12-19T16:42:41Z","message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","backport:version","Feature:Rule MITRE
ATT&CK®","v9.3.0","v9.4.0","v9.2.4","v9.1.10","v8.19.10"],"title":"[Security
Solution] Updates kibana MITRE data to
`v18.1`","number":246770,"url":"https://github.com/elastic/kibana/pull/246770","mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249"}},"sourceBranch":"main","suggestedTargetBranches":["9.3","9.2","9.1","8.19"],"targetPullRequestStates":[{"branch":"9.3","label":"v9.3.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/246770","number":246770,"mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249"}},{"branch":"9.2","label":"v9.2.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.10","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.10","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

---------

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>

…) (#247154)

# Backport

This will backport the following commits from `main` to `9.3`:
- [[Security Solution] Updates kibana MITRE data to `v18.1`
(#246770)](#246770)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-12-19T16:42:41Z","message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249","branchLabelMapping":{"^v9.4.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","backport:version","Feature:Rule MITRE
ATT&CK®","v9.3.0","v9.4.0","v9.2.4","v9.1.10","v8.19.10"],"title":"[Security
Solution] Updates kibana MITRE data to
`v18.1`","number":246770,"url":"https://github.com/elastic/kibana/pull/246770","mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249"}},"sourceBranch":"main","suggestedTargetBranches":["9.3","9.2","9.1","8.19"],"targetPullRequestStates":[{"branch":"9.3","label":"v9.3.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.4.0","branchLabelMappingKey":"^v9.4.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/246770","number":246770,"mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v18.1` (#246770)\n\n##
Summary\n\nAddresses: #166152
for `9.3.0`\n\nUpdates MITRE ATT&CK mappings
to\n[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).\nLast
update was to `v17.1`
in\nhttps://github.com//pull/231375.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v18.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n\n## Acceptance Criteria\n\n- [x] User can
map and use new MITRE techniques in Security Solution\n- [ ] The
user-facing documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/docs-content/pull/4395\n\n## Test
Criteria\n\n- [x] Verify that new techniques (see the changelog link
above) are\navailable for mapping on the Rule Creation page under
\"Advanced\nsettings\"\n- [x] Verify that new techniques are available
on the MITRE ATT&CK\ncoverage
page","sha":"6b6a30ec72ae1737a7afa7bffaf4c4e6310a9249"}},{"branch":"9.2","label":"v9.2.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.1","label":"v9.1.10","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.10","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>

)

## Summary

Addresses: elastic#166152 for `9.3.0`

Updates MITRE ATT&CK mappings to
[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).
Last update was to `v17.1` in
elastic#231375.

To update,  I modified 


https://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v18.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.


## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/docs-content#4395

## Test Criteria

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

)

## Summary

Addresses: elastic#166152 for `9.3.0`

Updates MITRE ATT&CK mappings to
[`v18.1`](https://attack.mitre.org/resources/updates/updates-october-2025/).
Last update was to `v17.1` in
elastic#231375.

To update,  I modified 


https://github.com/elastic/kibana/blob/8da457eaa399310954edf4c98cfc0fb540ae48ad/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v18.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.


## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/docs-content#4395

## Test Criteria

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

> [!NOTE]  
> Will be merged on Jan 13, 2026

<!--
Thank you for contributing to the Elastic Docs! 🎉
Use this template to help us efficiently review your contribution.
-->

## Summary

Updates MITRE docs to display most recent versions in docs for the
`v18.1` update

## Related

 - Dev PR: elastic/kibana#246770

## Generative AI disclosure
<!--
To help us ensure compliance with the Elastic open source and
documentation guidelines, please answer the following:
-->
1. Did you use a generative AI (GenAI) tool to assist in creating this
contribution?
- [ ] Yes  
- [x] No  
<!--
2. If you answered "Yes" to the previous question, please specify the
tool(s) and model(s) used (e.g., Google Gemini, OpenAI ChatGPT-4, etc.).

Tool(s) and model(s) used:
-->

---------

Co-authored-by: Nastasha Solomon <79124755+nastasha-solomon@users.noreply.github.com>
Co-authored-by: Nastasha Solomon <nastasha.solomon@elastic.co>