In case you missed it, I did, last month MITRE split and renamed ATT&CK’s Defense Evasion to Stealth and Defense Impairment. And a few of the techniques have moved to Lateral Movement, Privilege Escalation, and Execution. They’ve planned this split since March, but I wasn’t following their blog on Medium.
(v18)
(v19)
If you were using TA0005, this remains unchanged for Stealth. Defense Impairment is now TA0112. Defenders and vendors may need to update categories in their tooling and documention. They have also merged and revoked a few sub-techniques you can read about in their v19 release.
If you’re auto building URLs in case management or documentation, the URL schemes remain unchanged as the Technique IDs persist and this scheme follows the latest release (v19).
https://attack.mitre.org/techniques/T{id}/
After reading the blog and updating my own mitigation tracker, it’s a welcomed change.
Stealth is about hiding from your defenses. Impair Defenses is about breaking them.
This paragraph was exceptionally notable to me because I think it’s a shared belief by most defenders not caught in the AI hype-cycle.
For AI-enabled techniques, the key distinction is the behavior, not the tool. AI can make those activities faster, cheaper, and easier to scale, but it doesn’t fundamentally change what the adversary is doing (yet!). ATT&CK focuses on the behavior, so the coverage stays useful even as specific models and platforms change. For social engineering, the same logic applies, as adversaries have always tried to manipulate people into taking specific actions. Whether that happens over email, voice, or a help desk call, the channel is how the behavior is delivered, and the behavior itself is the manipulation. Treating that manipulation as its own behavior category makes it easier for defenders to track and respond to it, no matter how adversaries implement it.
They’ve also added ICS, for the weird nerds in OT.
If your work involves a lot of MIRE mapping, be sure to catch up on this version change. If you don’t want to miss future updates, the RSS to their blog is https://medium.com/feed/mitre-attack
