Defense Evasion

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes.

Detect it with
Monitor handle opens on drive volumes that are made by processes to determine when they may directly access logical drives. Monitor processes and command-line arguments for actions that could be taken to copy files from the logical drive and evade common file system protections.

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

Detect it with
Some rootkit protections may be built into anti-virus or operating system software. There are dedicated rootkit detection tools that look for specific types of rootkit behavior.

Base64, packing, encryption, and steganography that keep payloads unreadable to static inspection.

Detect it with
High-entropy command lines, long encoded blobs in script block logs, packed binaries with tiny import tables.

Naming malware svchost.exe, planting it outside System32, or using right-to-left override in filenames.

Detect it with
Known system binary names running from non-system paths; signature mismatches against the expected publisher.

Writing code into another live process to run under its identity and evade process-based controls.

Detect it with
CreateRemoteThread and cross-process memory writes; RWX memory regions with no backing file on disk.

Deleting logs, files, and shell history, and timestomping artefacts to break timeline reconstruction.

Detect it with
wevtutil cl, `history -c`, mass file deletion in temp; MFT timestamps that disagree with $FILE_NAME.

Logging in with legitimate stolen credentials — the quietest way in and the hardest to distinguish from normal work.

Detect it with
Impossible travel, first-time ASN or country for the user, MFA fatigue patterns, logins outside the user's baseline hours.

Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.

Detect it with
Modifications to the Registry are normal and occur throughout typical use of the Windows operating system.

Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads.

Detect it with
Monitor for abnormal presence of these or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious.

Stealing or impersonating another process's token to inherit its privileges.

Detect it with
Process access with high-privilege rights (0x1410) against SYSTEM processes; SeDebugPrivilege use by unexpected binaries.

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it.

Detect it with
Detecting the action of deobfuscating or decoding files or information may be difficult depending on the implementation.

Adversaries may abuse BITS jobs to persistently execute code and perform various background tasks. Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).

Detect it with
BITS runs as a service and its status can be checked with the Sc query utility ( sc query bits ). Active BITS tasks can be enumerated using the BITSAdmin tool ( bitsadmin /list /allusers /verbose ).

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters. Various Windows utilities may be used to execute commands, possibly without invoking cmd.

Detect it with
Monitor and analyze logs from host-based detection mechanisms, such as Sysmon, for events such as process creations that include or are resulting from parameters associated with invoking programs/commands/files and/or spawning child processes/network connections.

Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.

Detect it with
Record network packets sent to and from the system, looking for extraneous packets that do not belong to established flows. The Wake-on-LAN magic packet consists of 6 bytes of FF followed by sixteen repetitions of the target system's IEEE address.

Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data. DCShadow may be used to create a rogue Domain Controller (DC).

Detect it with
Monitor and analyze network traffic associated with data replication (such as calls to DrsAddEntry, DrsReplicaAdd, and especially GetNCChanges) between DCs as well as to/from non DC hosts.

Adversaries may exploit a system or application vulnerability to bypass security features.

Detect it with
Exploitation for defense evasion may happen shortly after the system has been compromised to prevent detection during later actions for for additional tools that may be brought in and used. Detecting software exploitation may be difficult depending on the tools available.

Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files.

Detect it with
Monitor script processes, such as cscript, and command-line parameters for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.

Living-off-the-land binaries (rundll32, mshta, regsvr32, msiexec) executing payloads under trusted names.

Detect it with
LOLBins with network connections or unusual command lines; check the LOLBAS project for expected arguments.

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Detect it with
Use process monitoring to monitor the execution and arguments of msxsl.exe and wmic.exe.

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

Detect it with
Analyze process behavior to determine if user document applications (such as Office) are performing actions, such as opening network connections, reading files, spawning abnormal child processes (ex: PowerShell), or other suspicious actions that could relate to post-compromise…

Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

Detect it with
Monitor and investigate attempts to modify ACLs and file/directory ownership.

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

Detect it with
Detecting the use of guardrails may be difficult depending on the implementation. Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.

Group Policy and tenant-level trust changes that grant the adversary durable elevated rights.

Detect it with
GPO modifications outside change windows; new federated trust or domain added to the tenant.

Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

Detect it with
Virtualization, sandbox, user activity, and related discovery techniques will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Adversaries may create cloud instances in unused geographic service regions in order to evade detection. Access is usually obtained through compromising accounts used to manage cloud infrastructure.

Detect it with
Monitor system logs to review activities occurring across all cloud environments and regions. Configure alerting to notify of activity in normally unused regions or if the number of instances active in a region goes above a certain threshold.

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system.

Detect it with
Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes. Take snapshots of boot records and firmware and compare against known good images.

UAC bypasses, sudo abuse, setuid binaries, and elevated COM interfaces.

Detect it with
fodhelper.exe / computerdefaults.exe registry hijacks; sudo invocations by service accounts.

Pass-the-hash, pass-the-ticket, and stolen web session cookies authenticating without the password.

Detect it with
NTLM logons where Kerberos is expected; a logon with no preceding interactive credential entry.

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

Detect it with
Collect and analyze signing certificate metadata on software that executes within the environment to look for unusual certificate characteristics and outliers.

Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.

Detect it with
Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer.

Disabling EDR, AV, firewall rules, or logging to blind the defenders before the noisy work begins.

Detect it with
Event ID 1102 (audit log cleared), 104 (log cleared), Defender tamper alerts, agent heartbeat gaps.

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

Detect it with
Monitor files, processes, and command-line arguments for actions indicative of hidden artifacts. Monitor event and authentication logs for records of hidden artifacts being used.

Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Detect it with
Monitor file systems for moving, renaming, replacing, or modifying DLLs. Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, etc., are suspicious.

An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses.

Detect it with
Establish centralized logging for the activity of cloud compute infrastructure components.

Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation.

Detect it with
Consider monitoring network traffic on both interfaces of border network devices with out-of-band packet capture or network flow data, using a different device than the one in question.

Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.

Detect it with
There is no documented method for defenders to directly identify behaviors that weaken encryption. Detection efforts may be focused on closely related adversary behaviors, such as Modify System Image.

Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.

Detect it with
Most embedded network devices provide a command to print the version of the currently running operating system. Use this command to query the operating system for its version number and compare it to what is expected for the device in question.

Adversaries may deploy a container into an environment to facilitate execution or evade defenses.

Detect it with
Monitor for suspicious or unknown container images and pods in your environment. Deploy logging agents on Kubernetes nodes and retrieve logs from sidecar proxies for application pods to detect malicious activity at the cluster level.

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry.

Detect it with
Monitor for unexpected Docker image build requests to the Docker daemon on hosts in the environment. Additionally monitor for subsequent network communication with anomalous IPs that have never been seen before in the environment that indicate the download of malicious code.

Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.

Detect it with
Monitor for code artifacts associated with reflectively loading code, such as the abuse of .NET functions such as Assembly.Load() and Native API functions such as CreateThread() , memfd_create() , execve() , and/or execveat() . Monitor for artifacts of abnormal process execution.

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Detect it with
Debugger related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses.

Detect it with
Monitor for common command-line editors used to modify plist files located in auto-run locations, such as \~/LaunchAgents , ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm , and an application's Info.plist .

Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may attempt to modify hierarchical structures in infrastructure-as-a-service (IaaS) environments in order to evade defenses.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.

Adversaries may fake, or spoof, a sender’s identity by modifying the value of relevant email headers in order to establish contact with victims under false pretenses.

Detect it with
No MITRE detection guidance published. Build coverage from the parent technique and your own telemetry.