What MITRE ATT&CK v19 changes for threat hunters

What changed in ATT&CK v19?

MITRE's April 2026 update notes describe the main structural change in version 19: the Enterprise tactic previously called Defense Evasion was divided in two. The tactic ID TA0005 now carries the name Stealth. A new tactic, Defense Impairment, was added with the ID TA0112, and MITRE's page for it records a creation date of 14 April 2026. MITRE describes Defense Impairment as covering adversary efforts to undermine security mechanisms and monitoring.

With the split, the Enterprise matrix lists 15 tactics, and the April 2026 update page counts 222 Enterprise techniques. The order in the matrix is now: Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact.

A later point release followed. MITRE's updates page dates v19.2 to 6 August 2026 and describes it as the first release in a narrower-scope agile format. It adds groups, including ShinyHunters and TeamPCP, and related supply chain software. It does not change the tactic list.

Why does a renamed tactic matter to a hunter?

Because hunters use tactics as filing labels. A hypothesis such as "an attacker is hiding a scheduled task by giving it a system-like name" was filed under Defense Evasion. A hypothesis such as "an attacker turned off audit logging on a server before moving on" was filed there too. After v19 these two ideas sit in different places. The first is about staying unseen, which fits Stealth. The second is about breaking the defender's instruments, which fits Defense Impairment. Those are illustrations of the distinction, not quotations from MITRE; the technique pages on attack.mitre.org are the reference for where each technique now sits.

The split is useful for hunting. "Is anything hiding?" and "Has anything been switched off?" are different questions with different data. Hiding shows up in process, file and registry telemetry. Impairment often shows up as absence: a sensor that stopped reporting, a log source that went quiet, a policy that changed. A hunt for impairment frequently starts by looking for gaps in the data rather than for events inside it.

What should you re-check after the update?

• Hunt hypotheses and playbooks. Any hypothesis tagged TA0005 before v19 needs a second look. Some belong under Stealth, some under Defense Impairment (TA0112).
• Hunt logs and reports. If you report hunting activity by tactic, older entries were counted under 14 tactics. Note the version on every report so a jump in the tactic count is not read as new work.
• Coverage maps. A coverage view built on v18 shows 14 columns. Mapping it onto v19 is not automatic, because rules filed under Defense Evasion have to be sorted into one of the two new tactics.
• Detection metadata. If your rules carry ATT&CK tags in a repository, a one-off review of every TA0005 tag is cheaper than finding the mismatch in an audit later. See detection-as-code.
• Training material. New analysts will read the current matrix. Internal documents that still say Defense Evasion will confuse them.

What should you ask vendors?

Every tool in our ranking describes some form of ATT&CK mapping, and ATT&CK coverage evidence is one of the seven criteria we score. After v19, three questions are worth adding to any demo:

1. Which ATT&CK version is your mapping built on, and when was it last updated?
2. Do your hunts and detections distinguish Stealth (TA0005) from Defense Impairment (TA0112)?
3. When you show a technique as covered, is that a deployed rule, a rule that has been tested against data, or a hunt that has run?

The third question matters regardless of version. A mapping records what a rule is meant to find. It does not show that the rule works on your data. Our MITRE ATT&CK coverage field note covers how teams measure the difference.

How do you hunt for Defense Impairment?

Start with the data you would expect to lose. For each important log source, write down what normal volume and timing look like. A hypothesis in this area often takes the form "a source that should report every few minutes went silent on one host while nearby hosts kept reporting". That is testable, it maps to TA0112, and it can be turned into a standing detection once you know what normal looks like. Our lesson on writing a hunt hypothesis walks through the format, and reading an ATT&CK tactic page shows how to use MITRE's own pages to pick techniques.

Tools that hunt across several sources in place can help here, because a missing signal in one system can be checked against another. An endpoint that stopped sending EDR telemetry but still appears in identity logs is a clear lead. The data source grid shows which source types each tool's public pages name.

Is there anything v19 does not change?

The principles are the same. ATT&CK is still a description of observed adversary behavior, not a checklist to complete. A tactic column with no rules in it is a question to investigate, not proof of exposure. And a column full of rules is not proof of safety until those rules have been tested. What v19 changes is the vocabulary, and hunters who keep their notes in the current vocabulary will find it easier to compare their work with MITRE's pages, with vendor material and with each other.

Sources

• MITRE ATT&CK, Updates April 2026
• MITRE ATT&CK, Enterprise tactics
• MITRE ATT&CK, TA0112 Defense Impairment
• MITRE ATT&CK, Updates

Related

• MITRE ATT&CK coverage
• Reading an ATT&CK tactic page
• Best threat hunting tools of 2026