Tags appendix: ATT&CK tactic list is out of date (defense-evasion renamed, four tactics missing)

[Daniel-Andrawis]

Summary

The tactics list in specification/sigma-appendix-tags.md (v2.1.0, 2025-08-02) is out of date with the current ATT&CK matrix. One listed tactic has been renamed by MITRE, and four current tactics are missing.

The practical consequence is that a rule tagged according to the published specification fails validation, because pySigma carries the newer ATT&CK data.

Evidence

attack.defense-evasion is listed in the appendix, but MITRE renamed TA0005:

Tactic ID	attack.mitre.org page title	In appendix v2.1.0
TA0005	Stealth, Tactic TA0005 - Enterprise	listed as defense-evasion
TA0042	Resource Development, Tactic TA0042 - Enterprise	missing
TA0043	Reconnaissance, Tactic TA0043 - Enterprise	missing
TA0112	Defense Impairment, Tactic TA0112 - Enterprise	missing

Diffing the appendix list against the ATT&CK data bundled with pySigma 1.5.0:

in spec but not valid today : ['defense-evasion']
valid today but not in spec : ['defense-impairment', 'reconnaissance',
                               'resource-development', 'stealth']

Reproduction

With sigma-cli 3.1.0 / pySigma 1.5.0, tagging a rule with the value the specification documents:

tags:
  - attack.defense-evasion

issue=InvalidATTACKTagIssue severity=medium description=Invalid MITRE ATT&CK tagging tag=attack.defense-evasion

Testing all twelve tactics currently listed in the appendix, eleven validate and only defense-evasion is rejected. attack.stealth validates.

To be explicit: pySigma is correct here. It reflects the current matrix. The specification is what needs updating.

Suggested fix

In specification/sigma-appendix-tags.md, under ### Namespace: attack:

• rename defense-evasion to stealth (TA0005)
• add reconnaissance (TA0043)
• add resource-development (TA0042)
• add defense-impairment (TA0112)

Happy to open a PR if that would be useful.

Environment

• sigma-cli 3.1.0, pySigma 1.5.0
• sigma-appendix-tags.md v2.1.0, release date 2025-08-02
• Verified against attack.mitre.org on 2026-09-01