166 terms · 75/46/45
Technique № 012 · class: execution

Impair Defenses

Defense evasion encompasses techniques by which an attacker conceals their activity from security tools, analysts, and automated detection systems. The goal is to remain undetected for as long as possible in the compromised environment.

Term

description · examples · notes

Defense evasion encompasses techniques by which an attacker conceals their activity from security tools, analysts, and automated detection systems. The goal is to remain undetected for as long as possible in the compromised environment.

Description

Methods include disabling security software, clearing activity logs, disguising malicious processes with legitimate names, using encryption, and exploiting legitimate system tools.

Examples

  • Disabling antivirus software on a compromised system
  • Clearing system logs that record attacker activity
  • Executing malicious code through legitimate system tools
  • Encrypting command server communication to resemble normal traffic

Notes

  • Centralized log collection outside the compromised system makes it harder for the attacker to erase traces.

Mentioned in the news

tags
evasion execution
◳Composite

Threats

used by 8

Threats that use it. Select one to open its page.

Defenses

countered by 7

How it is countered. Select one to open its page.