The Stealth and Defense Impairment Tactics in ATT&CK v19

Two kinds of concealment create different detection questions

An attacker deletes command history. Another attacker disables endpoint protection. Both actions may help an intrusion remain undetected, but they change the environment in different ways. The first reduces traces or blends activity. The second interferes with a control that should observe, prevent, or report behavior.

ATT&CK v19 separates Stealth from Defense Impairment. Stealth describes behavior used to avoid notice or reduce the visibility of adversary activity. Defense Impairment describes behavior that weakens defensive mechanisms. The distinction helps you ask whether you are detecting concealment behavior, detecting degradation of a security dependency, or both.

Do not treat the tactic label as the evidence. Deleting a history file can occur during legitimate cleanup. Stopping a security service can occur during an approved upgrade. The label organizes adversary intent in the knowledge base; your analytic sees actions and state changes whose meaning depends on actor, authorization, sequence, and effect.

Model the defensive dependency that can be impaired

A control is not just a product name. It includes configuration, policy, sensor process, driver or extension, network path, collector, parser, analytic schedule, and delivery. An attacker may impair one layer while dashboards for the others remain green.

Choose the dependency the security claim needs. If an endpoint analytic depends on process-start events, relevant impairment includes audit-policy changes, sensor unload, filtering, collection blockage, parser failure, and rule disablement. Some are adversary behaviors; others are operational failures. Both can invalidate coverage even though their cause and response differ.

This leads to two complementary analytics. A threat analytic looks for unauthorized actions that weaken defenses. A health analytic looks for the expected evidence path becoming incomplete or stale. The first may suggest intent when joined with identity and sequence. The second establishes that confidence has degraded, even when cause is unknown.

Recognize stealth through changes in evidence, not mind reading

Stealth is difficult because the attacker is trying to reduce distinctive evidence. You may observe a change that supports a stealth assessment: timestamps altered after execution, logs cleared shortly before suspicious access, traffic routed through an expected service, or commands shaped to resemble administration.

Each observation has ordinary alternatives. Rotation clears logs. Deployment tooling changes files and timestamps. Privacy infrastructure changes network appearance. Administrators use the same interpreters attackers use. State the fact first, then the assessment that its relationship to other activity is consistent with avoiding notice.

Sequences often matter. A privileged session disables detailed auditing, changes a protected resource, and restores the setting. The temporary impairment and the action inside it support a stronger explanation than either alone. Missing evidence can never supply the hidden action by itself, so the alert must preserve that uncertainty.

Test whether the analytic survives the behavior it describes

A paradox appears when a detection relies entirely on the control an attacker is trying to impair. If endpoint telemetry is the only record of sensor shutdown, a successful shutdown may remove the completion event. Independent control-plane, operating-system, network, or management evidence can strengthen the design.

Validation should examine partial failure. What happens when the final event is absent, records arrive late, a host disappears from inventory, or the control reports healthy while a required event class stops? Can the result distinguish an observed disable action from inferred silence? Does the coverage state change when the dependency is unhealthy?

ATT&CK v19 Detection Strategies can organize relevant analytics and components, but local failure testing determines whether your implementation can see the behavior under real impairment.

Report degradation and suspected intent as separate conclusions

When a sensor stops reporting after a privileged policy change, you may know that the evidence path is degraded. You may assess that the change is suspicious. You may not yet know whether an attacker caused it, whether the action succeeded everywhere, or which behavior occurred during the gap.

Give the consumer both timelines: changes to defensive state and changes in activity around them. Include the actor and authorization context, affected population, last known good evidence, independent observations, and the exact coverage claims that can no longer be relied upon. This supports investigation without filling the blind period with invented certainty.

The v19 tactic split is valuable because it encourages precision. Stealth analysis asks how activity was made less noticeable. Defense Impairment analysis asks how protective capability was weakened. Operational assurance asks whether the evidence is currently trustworthy. Keeping those questions distinct produces clearer detections and safer decisions.