SECURITYATLAS✳

✳ Adversary behavior knowledge base / ATT&CK v19.2

MITRE ATT&CK

MITRE ATT&CK is a knowledge base of adversary tactics and techniques observed in the world, used to describe how attacks unfold. Version 19.2 was released on 6 August 2026. Version 19 split the former Defense Evasion tactic into Stealth and Defense Impairment; do not reuse older tactic counts as if they were current. ATT&CK is a language for behaviors and evidence, not a scoring system that proves defensive coverage.

Adversary behavior knowledge baseATT&CK v19.2Last reviewed

What it helps you do

Help detection engineers and investigators name behaviors (“what did they do?”) and hunt for evidence of those behaviors. Meridian Space & Robotics can tag the Dax Mercer case with relevant techniques once evidence exists, without coloring a matrix cell and declaring victory.

A useful way to begin

  1. Pick one real case and map only techniques supported by evidence, leaving the rest unmarked.
  2. Read the v19 change that split Defense Evasion so detections are filed under Stealth or Defense Impairment as appropriate.
  3. Use ATT&CK to ask “what telemetry would show this technique?” rather than “what percentage is green?”
  4. Cite the version (v19.2) in any mapping you keep.

What good evidence looks like

For one technique that matches evidence you already have, a note of the telemetry source, an example of the analytic logic, and a known blind spot. A heatmap with unexplained green cells is not that note.

Other records you might already have

  • A case note that cites a technique ID and the log line that actually matched, plus coverage gaps.
  • A detection test showing the export behavior was or was not visible after v19.2 labels were applied.

Common misconceptions

ATT&CK coverage percentage means the organization is secure.

ATT&CK v19.2 describes adversary behaviors. A percentage is not a compliance score and not proof of protection.

One detection paints the technique green forever.

A detection shows what that analytic saw in that telemetry. It does not close the technique for every later case.

We should fill every cell.

MITRE’s own guidance says not to treat ATT&CK as a checklist. Map techniques you can support with evidence, and leave the rest unmarked.

Related lessons

This is an original educational guide. Use the publisher’s official materials for the authoritative requirements and licensing terms. A relationship between maps is not one-to-one control equivalence.

Find your next idea.

Tip: press / to open search. Escape closes this window.