MITRE ATT&CK v19 Drops April 28: How to Prepare Your SOC for the Defense Evasion Split

### Executive Summary: MITRE ATT&CK v19 splits the long-standing Defense Evasion (TA0005) tactic into two distinct tactics—Stealth (which inherits TA0005) and Impair Defenses (new tactic ID)—changing how techniques are categorized and how SOCs should triage and detect related behaviors. The post outlines the operational differences between hiding vs. breaking defenses, notes the retirement/elevation of T1562, and recommends auditing TA0005/T1562 references, testing detections, planning for absence-of-signal monitoring, and updating SOAR playbooks before the April 28, 2026 release.