Defense Evasion Split: A Tale of Two Tactics
Brief
By Allison Henao and Alice Koeninger, Art by Cat Self
If you’ve been following the ATT&CK community channels, you’ve probably heard us talking about changes to Enterprise’s Defense Evasion tactic ( ATT&CKcon 5. 0 , ATT&CKcon 6. 0 , #att&cking-mondays on Slack , etc). Those changes are almost here, with the release of ATT&CK v19 coming on April 28th. This post walks through what’s changing, why, what’s shipping in April, and what’s still ahead.
A Tactic Divided Against Itself
It was the best of tactics and the worst of tactics.
Defense Evasion has been one of the most heavily used tactics in ATT&CK, and sometimes one of the most frustrating to work with. It wasn’t wrong, per se. Adversaries want to stay hidden, and they continue to find creative, layered ways to accomplish that.