ATT&CK grew a 15th tactic: A practical DFIR field guide to the Stealth / Defense Impairment split
Summary
This article discusses the addition of a 15th tactic, 'Stealth / Defense Impairment', to the Enterprise MITRE ATT&CK matrix. It aims to provide practical guidance for Digital Forensics and Incident Response (DFIR) professionals on identifying artifacts and tooling related to this new tactic.
IFF Assessment
The article provides new information and tools for defenders to better identify and understand adversary tactics, thus strengthening their defensive posture.
Defender Context
The MITRE ATT&CK framework is a crucial resource for understanding adversary behavior. The addition of a new tactic like 'Stealth / Defense Impairment' means defenders must update their detection and response strategies to account for these newly defined behaviors. Understanding the artifacts and tools associated with this tactic will be vital for effective incident investigation.