MITRE ATT&CK tactics list (v20): all 15 Enterprise tactics explained

As of October 2026, the Enterprise matrix of MITRE ATT&CK has 15 tactics. In kill-chain order they are Reconnaissance, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Stealth, Defense Impairment, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration and Impact. Lists that show 14 tactics with "Defense Evasion" date from before April 2026, when v19 split that tactic in two.

The current release is ATT&CK v20, published on 13 October 2026. It added new techniques but left the tactic list unchanged from v19, so the 15 tactics below apply to both versions.

All 15 Enterprise tactics with their IDs

Every tactic has a TA identifier. The numbers do not follow the order of the matrix, because IDs are assigned when a tactic is created and are never reused. The official list lives on the Enterprise tactics page.

1. TA0043 Reconnaissance: collecting information to plan the operation. Example: Active Scanning (T1595).
2. TA0042 Resource Development: building or acquiring what the operation needs, such as servers, domains, accounts and tools. Example: Acquire Infrastructure (T1583).
3. TA0001 Initial Access: getting a first foothold in the target network. Example: Phishing (T1566).
4. TA0002 Execution: running attacker-controlled code on a local or remote system. Example: Command and Scripting Interpreter (T1059).
5. TA0003 Persistence: keeping access through reboots, credential changes and other interruptions. Example: Boot or Logon Autostart Execution (T1547).
6. TA0004 Privilege Escalation: moving from a regular user to administrator, root or SYSTEM-level rights. Example: Exploitation for Privilege Escalation (T1068).
7. TA0005 Stealth: hiding activity so it looks like normal operations, without touching the security tooling itself. Example: Obfuscated Files or Information (T1027).
8. TA0112 Defense Impairment: breaking, disabling or weakening security controls, logging and monitoring pipelines. Example: Disable or Modify Tools (T1685).
9. TA0006 Credential Access: stealing account names, passwords, hashes, tokens and keys. Example: OS Credential Dumping (T1003).
10. TA0007 Discovery: learning about the systems, accounts and network once inside. Example: Account Discovery (T1087).
11. TA0008 Lateral Movement: moving from one system to another in the environment. Example: Remote Services (T1021).
12. TA0009 Collection: gathering the data the attacker wants before taking it out. Example: Archive Collected Data (T1560).
13. TA0011 Command and Control: communicating with compromised hosts to direct them. Example: Application Layer Protocol (T1071).
14. TA0010 Exfiltration: moving stolen data out of the victim's environment. Example: Exfiltration Over Web Service (T1567).
15. TA0040 Impact: disrupting, manipulating or destroying systems and data. Example: Data Encrypted for Impact (T1486), the technique most closely associated with ransomware.

A technique can belong to more than one tactic. Scheduled Task/Job (T1053), for instance, sits under Execution, Persistence and Privilege Escalation, because the same mechanism can serve each of those goals.

What changed in v19: Stealth and Defense Impairment

The April 2026 release notes call the split of Defense Evasion into Stealth and Defense Impairment one of the biggest changes in v19. Defense Evasion had grown into the largest column in the matrix and mixed two different kinds of behaviour: hiding from defenders and attacking their tools.

Stealth (TA0005)

Stealth kept the old Defense Evasion ID, TA0005. It covers concealment: blending in with legitimate activity, obfuscating code, masquerading as trusted files and evading sandboxes. The key boundary is that these techniques do not modify security controls or interfere with telemetry. As of October 2026 the Stealth tactic page lists 31 techniques, including Masquerading (T1036), Process Injection (T1055), Indicator Removal (T1070), Valid Accounts (T1078) and Virtualization/Sandbox Evasion (T1497).

Defense Impairment (TA0112)

Defense Impairment is a new tactic with a new ID, TA0112. It groups techniques that actively damage what defenders rely on: endpoint agents, firewalls, event logs, cloud audit trails and authentication controls. The aim is that defenders lose visibility or can no longer trust what they see. As of October 2026 the Defense Impairment tactic page lists 18 techniques, among them:

• Disable or Modify Tools (T1685), with sub-techniques for Windows event logs, cloud logs, the Linux audit system and clearing logs
• Disable or Modify System Firewall (T1686), covering cloud, network device and Windows host firewalls
• Modify Authentication Process (T1556), including MFA and conditional access policy changes
• Domain or Tenant Policy Modification (T1484)
• Downgrade Attack (T1689) and Safe Mode Boot (T1688)

What happened to Impair Defenses (T1562)

The old Impair Defenses technique and its Indicator Blocking sub-technique were revoked in v19 and replaced by Disable or Modify Tools (T1685). If your detection rules, SIEM content or threat reports still map to T1562 or to "Defense Evasion", they reference retired objects. The old technique URLs now redirect to their replacements, and the v19 release notes list every revoked object with its successor, which makes remapping straightforward.

For teams that build coverage heatmaps, the practical effect is that one column became two. Old coverage percentages for Defense Evasion cannot be compared directly with the new ones for Stealth or Defense Impairment.

Tactics, techniques and procedures: the difference

ATT&CK is organised in three layers, often shortened to TTPs.

• Tactics are the attacker's goal at a given step, the "why". They are the column headers of the matrix and carry TA IDs.
• Techniques are the way that goal is reached, the "how". They carry T IDs such as T1566, and many have sub-techniques such as T1566.001 Spearphishing Attachment.
• Procedures are the specific implementations seen in the wild: which group or malware used a technique, and exactly how. They appear in the procedure examples on each technique page.

As of v20, the Enterprise matrix has 227 techniques and 479 sub-techniques under its 15 tactics, according to the v20 release notes.

Is the order of tactics a sequence?

The left-to-right order roughly follows the life of an intrusion, but it is not a strict sequence. Real attacks skip tactics, repeat them and loop back: an attacker may run Discovery, move laterally, then run Discovery again on a new host. Treat the order as a reading aid, not as a model of every attack.

Mobile and ICS matrices

ATT&CK also has separate matrices for mobile devices and industrial control systems, each with its own tactic list. As of v20 both have 12 tactics. The ICS matrix includes tactics specific to operational technology, such as Inhibit Response Function and Impair Process Control, and the Mobile matrix covers Android and iOS. The v19 split of Defense Evasion applied to Enterprise only.

The Enterprise matrix itself spans Windows, macOS, Linux, cloud (IaaS, SaaS, Office Suite, Identity Provider), network devices, containers, ESXi and the pre-compromise PRE platform. That makes it relevant to cloud and infrastructure teams, not only to endpoint security.

How often the list changes

MITRE publishes major ATT&CK releases twice a year, in April and October. According to the version history, v18.1 was current from 28 October 2025, v19.2 from 28 April 2026 and v20.0 from 13 October 2026. Tactic changes are rare; most releases add, revise or retire techniques. Before each release it is worth checking that tooling exports, detection mappings and training material still match the current IDs.

More defensive reference material is in our Security section, and exploited-vulnerability deadlines for US federal agencies are covered in our guide to CISA BOD 26-04.

Frequently asked questions

How many tactics are in MITRE ATT&CK?

As of October 2026 (v20), the Enterprise matrix has 15 tactics, and the Mobile and ICS matrices have 12 each. Enterprise went from 14 to 15 in April 2026, when v19 split Defense Evasion into two tactics.

What is the Stealth tactic in MITRE ATT&CK?

Stealth (TA0005) covers techniques that hide adversary activity by blending in, obfuscating or mimicking normal behaviour, without changing security controls. It replaced Defense Evasion and kept its TA0005 ID.

What is Defense Impairment TA0112?

Defense Impairment (TA0112) is a tactic added in ATT&CK v19 for techniques that disable, degrade or undermine security tools, logging and monitoring. Examples include Disable or Modify Tools (T1685) and Disable or Modify System Firewall (T1686).

Is Defense Evasion still a tactic in MITRE ATT&CK?

No. Since v19 (April 2026) Defense Evasion has been split into Stealth and Defense Impairment, and v20 kept that structure. Mappings that still use Defense Evasion should be updated.

What does a MITRE ATT&CK tactic ID look like?

Tactic IDs start with TA followed by four digits, for example TA0002 for Execution. Technique IDs start with T, such as T1059, and sub-techniques add a suffix, such as T1059.001.