ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split

If you’ve opened the Enterprise ATT&CK matrix recently, you may have done a double-take. The familiar Defense Evasion column is gone. In its place sit two tactics: Stealth (TA0005) and Defense Impairment (TA0112). The Enterprise model now spans 15 tactics rather than 14.

It’s a taxonomy change that makes sense, but it could disrupt your detection engineering, playbooks, and the way you narrate an intrusion in a report. Any content mapped to the old Defense Evasion tactic now belongs to one of two phases with different intent and, crucially for responders, different forensic footprints.

The change makes sense in light of current trends. Adversaries have leaned harder into both tactics over the last few cycles: living-off-the-land to stay quiet, then aggressively disabling telemetry the moment they need room to operate. A framework that treats those as one tactic makes it easy to under-invest in one while over-reporting the other. The split forces an honest audit of both.

Below, I'll show how the new categories improve clarity and offer a phase-by-phase field guide, with artifacts and tooling that you can use to align with the new tactics this week.

Why splitting the Defense Evasion ATT&CK tactic actually helps

Defense Evasion bundled two very different adversary goals: staying hidden and actively breaking the things that would otherwise catch them. Separating them sharpens both detection and response:

• Stealth (TA0005) is about blending in.
  Examples include: timestomping ($SI vs $FN mismatches), alternate data streams, packing and encoding, masquerading as legitimate binaries. The evidence is subtle and lives in the file system and on disk.
• Defense Impairment (TA0112) is about degrading the defender.
  Examples include: clearing Windows event logs (1102), disabling Defender via registry tampering, modifying the firewall, stopping security services. The evidence is louder, and attackers will try to destroy it.

When you’re being attacked at 2 a.m., “They hid” and “they blinded us” is an important distinction that leads to different collection priorities, different timelines, and different conversations with the customer.

Stealth and defense impairment look different for identity and cloud

The host is only half the picture. Modern intrusions increasingly hide inside identity and SaaS using stolen session tokens, OAuth consent grants, and sign-ins that look perfectly legitimate. In that environment, stealth looks like a valid token with broad access. Defense Impairment looks like someone disabling conditional access or muting an alerting policy. There’s usually no timestomping or event log clearing. For DFIR, the key questions will always be: what did they leave behind, and how do I pull it apart? But in modern environments, the artifacts move to sign-in logs, unified audit trails, and provider telemetry, and your tooling needs to shift accordingly.

The DFIR field guide to the new ATT&CK tactics: two questions for every phase

Rather than asking you to re-learn the revised Enterprise matrix, I mapped it to how responders actually work. For each of the 15 tactics, the reference below answers two questions: what did they leave behind, and how do I pull it apart? The reference provides a condensed artifact-and-tooling view (tooling listed alphabetically). The full technique sheet extends this to 43 techniques with data sources and detection analytics.

Download the field guide spreadsheet here.

Cross-cutting platforms operate across every phase: KAPE and Velociraptor for triage and collection, Plaso for super-timelines, and Sigma, YARA, and ATT&CK Navigator for detection and coverage mapping.

A field-tested, non-theoretical guide

This mapping is built from real Sophos Incident Response engagements. Across those engagements, the same pattern keeps showing up: the artifact was there before the alert was.

• Post-MFA session abuse, hands-on-keyboard case. What broke the case was sign-in artifacts and host telemetry correlated on a timeline, well before anything alerted.
• Ransomware work. The “Impact” evidence was mass file-extension changes, ransom notes, and shadow-copy deletion, all present long before a tool fired.
• Threat hunts. Progress came from knowing which artifact would confirm or kill a hypothesis for a given phase.

That's what an artifact-first posture buys you. An alert tells you something happened. The artifacts tell you what happened, when, how far it spread, and whether you've scoped it. So treat the tactic split as a prompt to check your collection: can you evidence both the hiding and the blinding behaviors, given that attackers do both? 

The team behind the mapping

A field guide is only as good as the caseload behind it. The Sophos Incident Response practice runs thousands of engagements every year, across every sector and region. The team is drawn from national, military, and organizational CSIRTs, law enforcement, and intelligence backgrounds, backed by the threat intelligence of Sophos X-Ops. That real-world experience and volume is how we know that patterns like “artifact-first” hold up. It’s also why our median attacker dwell time in real cases now sits at just three days. The response speed and pattern-recognition compound.

How to use the field guide this week

1. Re-tag your detections. Anything mapped to Defense Evasion should now resolve to Stealth or Defense Impairment. The split changes how you report coverage.
2. Test your updated collections. Pick a few phases and confirm that you acquire the listed artifacts before an incident surfaces any flaws.
3. Operationalize the list. Add the artifact list into triage runbooks and compromise-assessment templates so it's already in front of responders during an engagement

The full 15-tactic matrix and the filterable technique sheet are attached. The teams that adapt their evidence strategy and not just their labels will be the ones who scope faster and eradicate cleaner.

Let’s compare notes

The full 15-tactic matrix and the filterable technique sheet are available here for download. The teams that adapt their evidence strategy and not just their labels will be the ones who scope faster and eradicate cleaner.

_____

Active incident? Get help now.

Sophos DFIR is a 24/7 service for Sophos and non-Sophos customers alike. Request emergency assistance at sophos.com/emergency-response. Onboarding starts within hours, and most customers are triaged within 48 hours.

Not on fire? Get ahead of it.

The Sophos Security Services Retainer (SSR) converges proactive testing, readiness, and guaranteed DFIR into one model that includes defined response SLAs, pre-negotiated rates, and Service Units for pen-testing, tabletop exercises, and more. sophos.com/retainer