Low probability of detection describes designs or techniques intended to make signals, activity or communications difficult to notice. It can be used for covert channels, stealth malware or hidden wireless transmissions. Defenders counter it by increasing sensor coverage, looking for anomalous timing or power patterns, and correlating weak signals across multiple data sources.
How low probability of detection is engineered
Low probability of detection works by reducing the observability of a signal, action, or transmission below what routine monitoring expects. That can mean lowering power, shortening burst duration, randomising timing, blending into normal traffic patterns, or using frequency and protocol choices that make the activity harder to separate from background noise.
It is less about being invisible and more about staying beneath detection thresholds long enough to achieve the objective. In practice, the design challenge is to shape the emission, cadence, or artefact so that a defender’s sensors see something that looks ordinary, ambiguous, or too weak to justify immediate escalation.
The same idea applies across different environments. A covert channel might hide data inside routine communications, stealth malware may suppress obvious behaviour until it has finished its task, and hidden wireless transmissions can exploit the limits of range, sampling, or antenna coverage.
Why defenders miss it
Detection fails when a control stack relies on single sensors, static thresholds, or a narrow view of the environment. Weak signals are easy to miss individually, especially when they are distributed across time, systems, or layers that are usually monitored separately.
Good detection therefore depends on correlation, not just collection. Analysts need to compare timing, power, protocol behaviour, and content patterns across sources so that low-amplitude activity becomes visible as a relationship rather than as one obvious alert. MITRE D3FEND is useful here because it frames defensive countermeasures around the techniques adversaries try to hide.
Coverage gaps matter as much as threshold gaps. If sensors do not observe a frequency band, an egress path, a host state, or a telemetry layer, the activity may be detectable in theory but invisible in practice.
What practitioners should look for
Low probability of detection is easiest to spot indirectly. Look for inconsistent timing, repeated low-volume bursts, unusual energy use, protocol fields that carry more variation than the application needs, or activity that appears normal only when viewed in isolation.
Correlating weak signals across logs, endpoint data, radio observations, network flow, and power or process telemetry often reveals patterns that a single source cannot explain. That is why practitioner teams should treat it as a fusion problem, not a single-alert problem.
SANS Security Resources is a practical reference point for detection engineering and incident handling because the response to stealthy activity usually depends on disciplined tuning, triage, and cross-source analysis rather than on one signature.
Risk and Threat Considerations
Low probability of detection is attractive because it extends dwell time. The more an adversary can operate below notice, the more time they have to exfiltrate data, move laterally, or maintain a covert communication path without triggering response.
Failure mechanism: The technique exploits blind spots, weak thresholds, and sensor fragmentation, so the defender sees too little, too late, or only after the activity has already blended into normal background behaviour.
Impact: Stealth improves the chance of successful covert operations and reduces the likelihood that containment begins during the initial stages of misuse or compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1027 — Obfuscated Files or Information | Stealth techniques rely on hiding behavior or data from standard visibility. |
| T1001 — Data Obfuscation | Low-probability detection often uses concealed or blended communications. | |
| Recommendation — Map hidden activity to T1027 and hunt for obfuscation patterns across logs and endpoints. Correlate suspicious traffic patterns with T1001-style obfuscation and inspect for covert channels. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Detection of subtle activity depends on sufficient telemetry and log correlation. |
| Recommendation — Centralise and retain logs so weak signals can be correlated across systems. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | This topic depends on continuously observing weak, abnormal, or blended signals. |
| Recommendation — Continuously monitor for anomalies that emerge only when multiple data sources are correlated. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Low-detectability techniques require review and analysis of collected telemetry. |
| Recommendation — Analyze audit records for timing, volume, and correlation anomalies that indicate stealth activity. | ||
Practitioner Guidance
What to prioritise: Focus first on detection coverage, not just alert volume. If a channel, protocol, or physical medium can carry covert activity, you need at least one way to observe it directly or to infer it from correlated behaviour.
What to verify: Check whether your telemetry can distinguish normal low-rate variation from deliberately shaped emission. If you cannot tell the difference, then the control is not yet strong enough for stealth-oriented threats.
Practitioner takeaway: Low probability of detection is defeated by breadth of observation plus correlation, because stealth usually fails when weak signals are forced to compete against multiple independent views of the same activity.