A five-year ATT&CK technique series shows one technique dropping 30% - why is "they stopped" wrong?

## The obvious reading, and why it fails Someone puts a chart in front of you: one crew, five years, ATT&CK technique identifiers, and `T1550.001` down thirty percent. The obvious reading is that the crew moved away from using application access tokens. Your job is to explain why that is the wrong first conclusion, and to say what would have to be true before it became the right one. ## Confounder 1: the catalogue moved ATT&CK ships roughly twice a year and identifiers move between releases: some are revoked and replaced, some are deprecated, and some parents split into sub-techniques. The July 2020 v7 release did this at scale when sub-techniques were introduced. The behaviour "use an application's access token" was `T1527` before that release and `T1550.001` after it. If the early years of the series were written against the older releases and are counted by raw identifier, then the series is not one time series - it is two, glued together at a release boundary. The tell is distinctive and easy to check: **a cliff in one number, dated at a release boundary, with one or several new numbers being born in the same period.** That signature is a split or a revocation, not adversary behaviour. Adversaries do not change tradecraft simultaneously on the day a catalogue ships. ## Confounder 2: granularity drift Even within one release, a behaviour can be recorded at two levels. Someone who knows only that alternate authentication material was used writes the parent, `T1550`. Someone who knows it was an application token writes `T1550.001`. Both are correct; the second is more specific. Now suppose the material available in later years is thinner, or the people writing the mappings are more cautious about asserting detail. The parent's count rises, the child's falls, and the underlying behaviour is unchanged. A drop in a sub-technique's count is therefore ambiguous between "less of it happened" and "we were less willing to say which kind it was". Rolling both parent and child together removes the ambiguity - and often removes the drop. ## Confounder 3: you are counting the wrong noun The series counts **mappings**, which are labels that people wrote. It does not count adversary actions. The number moves when the volume of published material moves, when the number of people producing it moves, when the depth of their access to the underlying material moves, and when the conventions they follow move. None of those is the crew. ## Confounder 4: the identifier is not purely adversarial This one is specific to the technique and it is the sharpest. `T1550.001` describes using an application's issued access token. In a SaaS tenant, the entirely ordinary case looks the same: a provider's engineer with delegated administration holds a consented application carrying a mail-read scope, and it reads mailboxes exactly as granted, every day, for five years. A technique names a behaviour, not intent or authorisation, so that ordinary activity sits under the same identifier as an adversary's. Any count over that identifier is a count over a mixture, and the mixture's composition can shift on its own - a provider onboarding, a consolidation of apps, a scope tidy-up - producing a movement in the number with no adversary anywhere in it. ## What you actually do 1. **Pin a release.** Choose one ATT&CK version as the frame for the whole comparison and say which one it is. 2. **Migrate what is mechanically resolvable.** Follow the published replacement pointers for revoked identifiers. Keep the original identifier alongside the migrated one; never overwrite the history. 3. **Roll up to the coarsest common level.** If part of the series predates sub-techniques, comparing at parent level is the only honest comparison. Do not push old parent references down into children - the detail was never recorded, and inventing it manufactures precision. 4. **Handle the unresolvable explicitly.** Deprecated identifiers have no successor; mark them rather than letting them fall out silently. 5. **State what the number is.** It is a count of mappings written against a stated release, over a stated body of material, including any ordinary activity that fits the same behaviour. After all that, if the drop persists, you have a real change in **what was mapped**. That is still not a change in behaviour: you must also rule out changes in who was writing, how deeply they could see, and how the mixture of ordinary and adversarial activity under that identifier shifted. Only then does "the crew changed" become the leading explanation - and by then it is a claim you can defend rather than a shape on a chart. ## The one-sentence version An ATT&CK identifier is a shared vocabulary revised twice a year, and it was never built to be the axis of a five-year time series; when the numbers move, ask what the catalogue did before you ask what the adversary did.