News Date: 2026-09-14
The Enterprise MITRE ATT&CK matrix has expanded from 14 to 15 tactics, replacing the broad Defense Evasion category with two more precise concepts: Stealth and Defense Impairment. Sophos has published practical guidance explaining why the distinction matters for detection engineering, incident response and digital forensics.
Two Different Adversary Objectives
The former Defense Evasion category covered a wide range of behavior, from subtle concealment to the deliberate destruction of defensive visibility. Combining those actions under one heading made reporting convenient, but it could hide important differences in attacker intent and required response.
Stealth, identified as TA0005, describes attempts to blend into an environment or make malicious activity harder to recognize. Examples include masquerading as legitimate software, changing file timestamps, using alternate data streams, packing payloads and relying on trusted administrative tools.
Defense Impairment, identified as TA0112, covers actions that weaken the defender directly. Clearing Windows event logs, stopping endpoint protection, modifying firewall policies, tampering with Microsoft Defender settings or disabling cloud alerting rules all fall into this more aggressive category.
This separation is operationally useful. A stealthy attacker may leave faint but recoverable traces in file-system metadata, identity logs or command histories. An attacker impairing defenses may generate obvious configuration changes but quickly destroy the evidence investigators need. Each situation therefore demands different collection priorities and containment decisions.
Cloud and Identity Environments Also Matter
The distinction extends beyond endpoints. In Microsoft 365 or other cloud platforms, stealth may involve valid session tokens, carefully paced downloads or OAuth grants that resemble legitimate activity. Defense impairment may involve weakened conditional-access policies, muted alerts or altered audit configurations.
Actions for Security Teams
- Reclassify detections previously mapped to Defense Evasion.
- Update SIEM dashboards, threat-hunting queries and incident templates.
- Measure coverage for Stealth and Defense Impairment separately.
- Confirm that forensic collection survives attempts to disable local logging.
- Protect cloud audit settings and security policies with privileged access controls.
In my view, this is more than a taxonomy adjustment. Security teams frequently measure whether they can detect malware while paying less attention to whether an attacker can disable that detection. Separating quiet concealment from active defensive sabotage should expose those blind spots. Organizations that merely rename their rules will gain little, while those that reassess telemetry, retention and response authority can turn the revised matrix into a meaningful improvement.