[FR] Migrate rules from retired Defense Evasion tactic (Stealth TA0005 / Defense Impairment TA0112)

[shashank-elastic]

Related Issues

Related to #6366, #3290

Summary

This issue tracks the Rule Updates themselves, while #6366 tracks the tooling necessary to update the rules. They may be resolved by the same PR.

MITRE ATT&CK v19.0.0 introduces major Enterprise matrix changes: the Defense Evasion tactic was retired and split into Stealth (TA0005) and Defense Impairment (TA0112). When we pull the latest v19.0.0 data in this repo it reflects the new tactic names, but hundreds of detection rules still declare the retired tactic label Defense Evasion and tooling that resolves tactics from MITRE data fails with KeyError: 'Defense Evasion'.

This issue tracks aligning rule metadata and tags with ATT&CK v19.

Observed failure

When running dev tooling that rebuilds threat metadata (e.g. update_attack_in_rules → attack.build_threat_map_entry), execution fails at tactic lookup:

KeyError: 'Defense Evasion'

Stack location: detection_rules/attack.py — tactic_id = tactics_map[tactic] (build_threat_map_entry), because tactics_map is keyed by tactic name values from the loaded STIX file (x-mitre-tactic), which no longer includes "Defense Evasion".

After refresh, the bundled data uses tactic display names such as Stealth (TA0005) and Defense Impairment (TA0112), not the legacy umbrella name.

MITRE v19 context (Enterprise)

• Defense Evasion tactic retired; work split across:
  • Stealth (TA0005): hiding activity (obfuscation, indicator removal, injection, etc.).
  • Defense Impairment (TA0112): disabling or weakening security controls (EDR tampering, destructive changes to defensive configurations, etc.).
• Technique/tactic associations were reshuffled; the Enterprise matrix counts changed (MITRE cites updated technique/sub-technique totals).

Important: TA0005 remains as an ID but now denotes Stealth, not “Defense Evasion.” Rules must be updated by technique-to-tactic mapping from v19 STIX, not by renaming every rule to a single new tactic.

Scope in this repository

Approximate counts (TOML under rules/ and rules_building_block/):

Area	Count
Files with threat tactic name = "Defense Evasion"	695
├─ rules/	646
└─ rules_building_block/	49
hunting/	0 (no matches in current scan)

The same 695 files use id = "TA0005" with reference pointing at https://attack.mitre.org/tactics/TA0005/ for that block; semantics and display names should be reconciled with Stealth per v19.

Additional cleanup

• many rules still carry tags such as Tactic: Defense Evasion; those should be updated once tag conventions for Stealth / Defense Impairment are decided.
• In detection_rules/schemas/definitions.py EXPECTED_RULE_TAGS "Tactic: Defense Evasion" should be removed and the new Tactic names "Tactic: Stealth" and "Tactic: Defense Impairment should be added
• Historical detection_rules/etc/api_schemas/** references to Defense Evasion may need alignment with Kibana / minimum stack expectations. --> This is only 7.X versions and no additional cleanup may be required here
• Filename changes needed : When you change [[rule.threat]] tactic names from Defense Evasion to Stealth and/or Defense Impairment (exact strings must match what you put in TOML and what MITRE uses in your bundle)

New primary tactic name (example)	Required filename prefix
Stealth	stealth_
Defense Impairment	defense_impairment_

Proposed approach

1. Pull in the latest MITRE versions v19.0.0
2. Source of truth: Use the repo’s bundled attack-v*.json.gz (and detection_rules.attack.matrix / technique kill-chain phases) to determine which tactic (Stealth vs Defense Impairment) each listed technique ID belongs to under v19.
3. Rule edits: For each affected rule, update [[rule.threat]] entries so tactic name, id, and reference match MITRE v19 for the techniques declared. Where techniques span both new tactics, split into separate [[rule.threat]] blocks (one tactic per block with the correct techniques).
4. Tags & schemas: Align Tactic: … tags and any allowed tactic enums with v19
5. Filenames of rules to be changed.
6. Rollout: Prefered to decouple with the release and rollout this as separate individual enhancement.

Acceptance criteria

• Bundled ATT&CK data version and tactic names are consistent with MITRE ATT&CK v19 Enterprise matrix for this branch.
• No rule threat metadata references the retired tactic string Defense Evasion as a tactic name (unless explicitly exempted by policy—default is none).
• python -m detection_rules workflows that rebuild or validate threat maps complete without KeyError for legacy tactic names.

[Mikaayenson]

1. We need to separate code changes from rule updates
2. We should also plan internally when we want to officially make this change. Changing rules may break things internally for customers so we can't just unilaterally make a replacement.
3. We also need to update https://github.com/elastic/detection-rules-explorer to reflect the change.

[Mikaayenson]

Update May 8th - Post DEX Sync on MITRE v19.1

Pending any other issues, here's how we plan to address MITRE v19.1:

• Add a new framework_version field to the MITRE framework object.
• Retain both defense evasion versions in each rule until 9.4 support drops
• Migrate all toml files to v19.1
• Add additional tags for the new mappings.
• Drop v18.1 once we drop 9.4 support
• On build, dynamically select the right mitre mappings and push to json assets (also shipping the mitre framework version).
• May need to reconcile inadvertent version bumps for the new mitre mappings to not cause toil for customers.
• Consider ATLAS and ICS if the schema aligns

[[rule.threat]]
framework = "MITRE ATT&CK"
framework_version = "18.1"

[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"

[[rule.threat.technique.subtechnique]]
id = "T1070.002"
name = "Clear Linux or Mac System Logs"
reference = "https://attack.mitre.org/techniques/T1070/002/"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/v18/TA0005/"


[[rule.threat]]
framework = "MITRE ATT&CK"
framework_version = "19.1"

[[rule.threat.technique]]
id = "T1070"
name = "Indicator Removal"
reference = "https://attack.mitre.org/techniques/T1070/"

[[rule.threat.technique.subtechnique]]
id = "T1070.002"
name = "Clear Linux or Mac System Logs"
reference = "https://attack.mitre.org/techniques/T1070/002/"

[[rule.threat.technique]]
id = "T1562"
name = "Impair Defenses"
reference = "https://attack.mitre.org/techniques/T1562/"

[[rule.threat.technique.subtechnique]]
id = "T1562.001"
name = "Disable or Modify Tools"
reference = "https://attack.mitre.org/techniques/T1562/001/"

[rule.threat.tactic]
id = "TA0005"
name = "Stealth"
reference = "https://attack.mitre.org/tactics/v19/TA0005/"

To prevent exploding the mappings, we need to see how we can deduplicate all other subtechniques/techniques/tactics.

[shashank-elastic]

Per slack discussion this is reassigned to @Mikaayenson