What is Defense Impairment in MITRE ATT&CK?
Defense Impairment is the tactic of disabling, degrading or interfering with security controls. MITRE ATT&CK introduced it in version 19, in April 2026, when it split the former Defense Evasion tactic into Stealth and Defense Impairment. Typical examples are switching off antivirus or endpoint agents, stopping or clearing logs, and changing firewall rules so that the attacker's traffic passes. On the host, the defence is tamper protection on security tools, an alert when an agent stops reporting, and administrator rights limited to few people. The network adds an independent view: a server whose endpoint agent went silent still has to use the network, and NetSenX keeps watching its behaviour, such as beaconing, scanning and uploads, on every plan. It does not see the agent's state itself; the endpoint console shows that, and it is worth checking daily.