What is the Stealth tactic in MITRE ATT&CK?
Stealth is the tactic of hiding malicious activity or making it look normal. Since version 19 of MITRE ATT&CK, released in April 2026, it takes over much of the former Defense Evasion tactic, which was split into Stealth and Defense Impairment. Stealth covers techniques such as masquerading as legitimate files or services, hiding artefacts and obfuscating files so that tools and people overlook them. Signature-based tools struggle here, because each piece looks ordinary on its own. What still shows is behaviour that does not fit a host's history: a regular rhythm to a new destination, or a workstation that suddenly talks to many servers. If you map detections to ATT&CK, update references to Defense Evasion. NetSenX looks for such behaviour from the network on every plan; it never decrypts traffic, so it judges patterns, not content.