Defense Evasion 18 articles

Overview Abuse of trusted cloud services involves adversaries leveraging legitimate cloud platforms and services to facilitate various stages of an attack. This technique enables attackers to blend malicious activity with…

Overview Bypassing application control is a technique used by adversaries to circumvent security mechanisms that restrict or block the execution of unauthorized software. This technique plays a critical role in…

Overview Disabling or modifying security tools is a technique used by adversaries to undermine defensive mechanisms within a target environment. This approach facilitates stealth and persistence by reducing the likelihood…

Overview Encoded Command Execution is a technique used by adversaries to run commands or scripts in an encoded format to evade detection and bypass security controls. This technique is commonly…

Overview Encrypted Payload Delivery is a technique used by adversaries to conceal malicious payloads within encrypted or obfuscated data streams during transmission. This method helps attackers evade detection mechanisms by…

Overview Fileless malware techniques involve executing malicious activities without writing files to disk, leveraging legitimate system tools and memory-resident code. These techniques are used throughout various stages of the attack…

Overview Kernel hooking techniques involve intercepting or modifying kernel-level functions to alter system behavior. Adversaries use these techniques to gain stealth, persistence, or elevated privileges during various stages of an…

Overview Living-off-the-Land (LotL) evasion techniques involve adversaries leveraging legitimate system tools, utilities, and features to carry out malicious activities while minimizing detection. These techniques play a critical role in the…

Overview Log clearing and log tampering are techniques used by adversaries to remove or alter evidence of their activities within system and security logs. These actions primarily serve to evade…

Overview Masquerading files and processes is a technique where adversaries disguise malicious files or processes to appear as legitimate system or application components. This method is used to evade detection…

Overview Obfuscated Files and Information is a technique used by adversaries to conceal malicious code, data, or communication within files or information streams. It plays a critical role in the…

Overview Process injection techniques involve an adversary inserting malicious code into the address space of another process to execute code stealthily. This approach enables attackers to evade detection, maintain persistence,…

Overview Reflective DLL Injection is a technique used by adversaries to inject a Dynamic Link Library (DLL) into the address space of a target process without using the Windows loader.…

Overview Rootkit deployment is a technique used by adversaries to maintain stealthy and persistent control over a compromised system by installing software that hides its presence and activities. It plays…

Overview Signed Binary Abuse for Evasion is a technique where adversaries leverage digitally signed legitimate binaries to execute malicious code while bypassing security controls. This approach is used throughout various…

Overview Tampering with endpoint protection involves adversaries manipulating or disabling security controls on endpoint devices to evade detection and maintain persistence. This technique is commonly employed during various stages of…

Overview Time-Based Evasion Techniques involve adversaries manipulating or exploiting timing mechanisms to avoid detection and analysis during cyber attacks. These techniques are employed across various stages of the attack lifecycle…

Overview Virtualization and sandbox evasion techniques are employed by adversaries to detect and circumvent environments designed for malware analysis and automated security inspection. These techniques play a critical role in…