MITRE ATT&CK v19 and autonomous hunts: remapping after the Defense Evasion split

By Autonomous Threat Hunting editors · 24 September 2026

• ATT&CK
• Frameworks

What changed in ATT&CK in 2026?

• 14 April 2026: MITRE created tactic TA0112, Defense Impairment, covering adversary efforts to undermine security mechanisms and monitoring.
• 28 April 2026: ATT&CK v19 divided the Enterprise Defense Evasion tactic into Stealth (TA0005) and Defense Impairment (TA0112). It lists 15 Enterprise tactics and 222 techniques.
• 6 August 2026, the date MITRE's updates page gives for v19.2: the first narrower-scope agile release, adding groups including ShinyHunters and TeamPCP with related supply chain software.

The Enterprise tactics page lists the current 15, from Reconnaissance (TA0043) to Impact (TA0040).

Why this matters more for autonomous systems

A person who writes a hunt labels it once. An autonomous system labels every hypothesis it writes, every hunt it runs and every rule it proposes, and it may build coverage views from those labels. Most vendors in this guide's directory state ATT&CK mapping in some form: Anvilogic describes coverage scoring against ATT&CK, Cotool maps the detection suite onto ATT&CK to surface gaps, Mars Security produces ATT&CK-mapped rules, Nebulock's LOCK framework starts with a hypothesis mapped to ATT&CK, and Vega promotes hunts to MITRE-mapped detections. When the framework changes, all of that content has to follow.

What can go wrong after a split?

• Orphaned labels: hunts and rules still tagged with the old Defense Evasion tactic, which v19 no longer lists as it was.
• Misleading coverage views: an ATT&CK coverage map built on the old structure can show gaps or overlaps that are artifacts of the version, not of your detections.
• Hypothesis drift: a system that generates hypotheses from ATT&CK descriptions may produce different hunts once technique descriptions or tactic assignments change.
• Mixed versions: intelligence written before the change, and hunts written after it, describing the same behavior with different labels.

How to check that a system keeps up

• Ask which ATT&CK version the system maps to today, and where that version is shown in the product.
• Ask how and when mappings are updated after a MITRE release, and whether existing hunts and rules are remapped or only new ones.
• Ask to see a rule that was mapped to Defense Evasion before v19 and how it is labeled now.
• If you export rules, for example as Sigma, check which tags the exported rules carry.
• Put a review trigger on every ATT&CK release, as the lesson on retiring and revising automated hunts suggests.

Agile releases change the rhythm

MITRE's description of v19.2 as the first narrower-scope agile release suggests smaller, more frequent changes. For automated systems that is easier to absorb one release at a time, but only if someone checks each one. A mapping with no version attached cannot be checked at all.

The label is not the test

Remapping keeps the vocabulary current. It does not show that a hunt finds the behavior. That still takes data, a hypothesis that names its sources, and a test against known activity, which the two-week trial plan includes.

Frequently asked questions

Sources

• MITRE ATT&CK, Enterprise tactics attack.mitre.org
• MITRE ATT&CK, TA0112 Defense Impairment attack.mitre.org
• MITRE ATT&CK, April 2026 update (v19) attack.mitre.org
• MITRE ATT&CK, updates attack.mitre.org
• Anvilogic, platform anvilogic.com
• Cotool, detect cotool.ai
• Mars Security launch announcement, Security Boulevard securityboulevard.com
• Nebulock, platform nebulock.io
• Vega, threat hunting vega.io
• SigmaHQ, Sigma repository github.com