Why is Defense Evasion an ATT&CK tactic column rather than a label for any quiet action?

## The tactic, stated precisely Defense Evasion is the goal of **avoiding, disabling, degrading or slipping past a control**. Like every ATT&CK tactic it names an intent, so the classifying question is the same one used everywhere else: *what did this action buy the operator?* If the answer is 'a control that would otherwise have stopped or exposed this did not', the tactic applies. If the answer is 'nothing — that control was never in the way', it does not, however unobtrusive the action was. ## The spend test The sharpest practical form of the question is economic. **Did the operator pay for it?** Evasion costs something: an extra step, a second binary, an encoding pass, a delay, additional risk of failure. An operator who would perform the action in exactly the same way in an estate with no controls at all is not evading anything. - `T1036` Masquerading — giving a file, task or process a name and location that reads as legitimate — is listed under Defense Evasion and nothing else. Renaming buys no execution, no access, no durability. Its only product is being taken for something else, so its only goal is evasion. - An ordinary scheduled job on a Linux fleet is inconspicuous because scheduled jobs are ordinary, not because anyone worked at it. The quietness is a free side effect of choosing a normal mechanism. Nothing was spent, so nothing was evaded. The distinction is between **quiet by investment** and **quiet by accident**, and only the first is a goal. ## What breaks when it is used as an adjective Treat 'evasive' as a property you attach to anything unobtrusive and three things go wrong. **The column stops discriminating.** Almost every competent action is unobtrusive relative to something. Tag them all and Defense Evasion becomes the largest column in the matrix while carrying no information: knowing an action is in it tells you nothing you did not know from the action itself. **You lose the ability to reason about cost.** The reason the column is worth having is that its contents are things the operator *chose to fund*. That makes them the place to ask what happens if the option is taken away — does the operator have a substitute, or do they have to abandon the step? A column full of accidentally-quiet actions cannot support that question, because most of its contents are not choices at all. **Remedies get aimed at the wrong thing.** If a scheduled job is classified as Defense Evasion because it looked innocuous, the natural remedy is aimed at innocuousness — restrict the mechanism, tighten what may look ordinary. But the operator was not buying innocuousness, so the remedy removes nothing they valued and they proceed unchanged with the same mechanism or the next one. The goals they actually pursued, Persistence or Privilege Escalation, are untouched. ## Multi-tactic membership is not the same mistake Care is needed not to over-correct. `T1078` Valid Accounts genuinely does carry Defense Evasion among its four tactics, and that is not adjective creep. There is a real argument there: an operator who chooses to work through a real account, rather than through their own implanted access, is accepting constraints — the account's rights, its normal working pattern, the risk that its owner notices — specifically because activity attributed to a real identity is not separable from that identity's own work. That is a paid-for choice. The membership survives the spend test; a quiet timer does not. ## The architectural payoff Once Defense Evasion is held to a goal rather than a vibe, the useful question becomes available: **which control was the operator working around, and what did working around it cost them?** That is answerable and it prices your control classes. A control that operators routinely spend two extra steps to get past is doing real work. A control nobody ever bothers to evade is either perfectly placed or entirely irrelevant, and the difference between those two is worth knowing. ## The wrong answer *'Anything stealthy is Defense Evasion.'* It confuses a property of the action with the goal behind it, inflates one column until it means nothing, and quietly assumes evasion is free. Evasion is never free — that is precisely why it earns a column of its own.