ATT&CK V18: THE DETECTION OVERHAUL YOU'VE BEEN WAITING FOR

Summary from the TLDR InfoSec newsletter

MITRE ATT&CK v18 introduces two new components, Detection Strategies and Analytics, replacing brief detection notes with detailed, behavior-based guidance that connects techniques to platform-specific analytics, log sources, and data elements. The enterprise domain introduces 13 new techniques, covering Kubernetes, CI/CD pipeline tampering, cloud databases, and ransomware preparation activities, including backup software detection and selective file exclusion, as well as adversary monitoring of their own threat intelligence. The framework suggests splitting the Defense Evasion tactic into Stealth (altering defender visibility) and Impair Defenses (disrupting security controls), while launching an ATT&CK Advisory Council for formal community input and establishing faster CTI releases independent of biannual framework updates.