Defence Evasion Techniques Guide: How Attackers Hide and How Defenders See Them

Most intrusions are not missed because no control existed, they are missed because the attacker either blended into normal activity or quietly switched the controls off. This guide is written for defenders and authorised testers only, and it describes techniques at the level of the MITRE ATT&CK descriptions, never as procedures. It explains how ATT&CK v20 splits the old Defense Evasion tactic into Stealth (TA0005) and Defense Impairment (TA0112), what each family looks like in telemetry, and which detections, hardening settings and response steps close the gaps. It is aimed at SOC analysts, detection engineers, endpoint owners and purple team leads who need a tactic-level map. For EDR-specific evasion such as driver abuse and agent tampering, see the EDR Evasion and Defence Guide, which this page does not repeat.

Key takeaways

• ATT&CK v20 splits evasion in two. Stealth (TA0005) covers hiding while leaving defences intact; Defense Impairment (TA0112) covers breaking or blinding the defences themselves. The older "Impair Defenses" technique has been revoked in this structure, so update mappings and detection content that still use it.
• Impairment is loud if you watch the right signals. A cleared Security log (event 1102), a changed audit policy (4719) or Defender real-time protection being disabled (5001) are rare in normal operations and deserve high-fidelity alerts.
• Stealth is beaten by baselines, not signatures. Masquerading, signed binary proxy execution and valid account use look legitimate one event at a time; process lineage, location and peer comparison expose them.
• Telemetry must survive the attacker. Forward logs off the host quickly, protect sensor configuration with tamper protection and change control, and alert when a source goes silent.
• Identity is the quietest evasion of all. T1078 Valid Accounts appears under Stealth because an attacker with real credentials, especially a service account, generates almost nothing that looks malicious.

What it is

Defence evasion is the set of behaviours an adversary uses to avoid being detected, or to stop defenders from trusting what they see, at every stage of an intrusion. Until ATT&CK v20 it was a single tactic. In v20 MITRE separates two goals that need different defensive thinking.

The distinction matters operationally. Stealth techniques leave your sensors working, so the evidence exists and the problem is recognition. Impairment techniques attack the sensors, so the evidence may stop arriving, and the problem is noticing an absence. A detection programme that is only tuned for malicious events will miss the second class entirely. See the MITRE ATT&CK Guide for Defenders for how tactics and techniques are structured.

How it works

The descriptions below stay at the level of the ATT&CK technique pages and focus on what each family changes and what it leaves behind.

Stealth: looking like normal

• Masquerading (T1036): artefacts are given names, locations or metadata that make them look legitimate, for example a file named like a system utility in an unusual folder (T1036.005 Match Legitimate Resource Name or Location). Renaming legitimate admin tools to dodge rules keyed on file names is also covered.
• Trusted binary proxy execution (T1218): signed, built-in operating system binaries are used to run content on the attacker's behalf, so allowlisting and signature checks see a trusted process. T1218.011 Rundll32 is a frequently observed example. This overlaps heavily with living off the land; see the Living off the Land Guide.
• Obfuscation and in-memory execution (T1027, T1055, T1620): content is encoded, packed or run inside another process's memory so that file scanning has little to inspect.
• Indicator removal (T1070): in v20 MITRE frames this as selective deletion or alteration of artefacts, such as file deletion (T1070.004) or command history edits, leaving enough intact for the system to look normal.
• Environment awareness (T1497, T1480): malware checks whether it is in a sandbox or the intended target and stays dormant otherwise, which defeats automated detonation.
• Valid accounts and social engineering (T1078, T1684): using real credentials, or persuading a user to take the action, produces events that are authorised by definition.

Defense Impairment: breaking the lights

• Disable or modify tools (T1685): stopping or reconfiguring EDR, antivirus, logging agents and sensors, or preventing them from updating. Sub-techniques include T1685.001 Disable or Modify Windows Event Log, T1685.002 Disable or Modify Cloud Log, T1685.004 Disable or Modify Linux Audit System Log and T1685.005 Clear Windows Event Logs.
• Firewall changes (T1686): host firewall rules are disabled or altered, either to open a path or to block a security agent from reaching its cloud console.
• Downgrade (T1689): forcing an older, weaker version of a feature or protocol that lacks modern controls, such as a scripting engine without logging.
• Policy and trust subversion (T1484, T1553, T1556): changing domain or tenant policy, undermining code signing or Mark-of-the-Web (T1553.005), or modifying the authentication process so controls apply differently.
• Exploitation for impairment (T1687): using a vulnerability in a security product or the platform to switch protection off.

In real intrusions the two are combined: ransomware operators commonly impair tooling shortly before encryption, while state actors favour stealth for long dwell times. ATT&CK also records T1679 Selective Exclusion, where ransomware deliberately avoids certain files so the system stays usable and less alarming.

How defenders detect, prevent and respond

Detection splits along the same line as the tactics: anomaly and lineage analytics for stealth, integrity and absence monitoring for impairment. The table lists high-value signals; the event IDs are from Microsoft documentation and Sysmon.

For Windows logging depth see the Windows Event Log Guide and the Sysmon Guide; for Linux see the Linux Logging and auditd for Defenders Guide. Write analytics as portable rules where you can (see the Sigma Rules Guide).

Prevention and hardening

1. Protect the sensors first. Enable tamper protection on endpoint security. In Microsoft Defender for Endpoint it keeps real-time protection, behaviour monitoring and cloud protection on, ignores Group Policy attempts to change them, raises an alert, and can protect antivirus exclusions when they are managed only through Intune or Configuration Manager. Microsoft documents that the setting is being renamed controlled configuration.
2. Get logs off the host fast. Forward events to a central store the endpoint administrator cannot alter, so local clearing removes only the local copy. See the Cloud Logging and Audit Trail Guide for immutable cloud trails.
3. Restrict who can impair. Disabling a sensor, clearing a log or changing audit policy needs administrative rights, so local admin reduction and tiered admin accounts remove most of the attack surface.
4. Constrain trusted binaries. Application control policies that block rarely used system binaries reduce proxy execution (D3-EAL Executable Allowlisting). See the Application Allowlisting Guide.
5. Govern exclusions. Every antivirus and EDR exclusion is a pre-built hiding place. Review them with an owner and expiry; the EDR Tuning and Exclusions Management Guide covers the process.
6. Remove downgrade paths. Disable legacy versions of scripting engines and protocols where business use has ended, so T1689 has nothing to fall back to.

Response

• Treat impairment as confirmed hostile until disproved: a cleared Security log or disabled real-time protection without a change ticket should open an incident, not a ticket in a queue.
• Isolate, then restore the control: contain the host, re-enable the sensor from central management, and preserve the forwarded logs that cover the gap.
• Look for the gap: an impairment event marks the start of a blind period. Reconstruct it from network, identity and cloud sources that the host could not reach.
• Re-baseline: after recovery, compare the host's security configuration with the gold baseline before returning it to service.

Measuring it

• Sensor health: percentage of endpoints with tamper protection enabled and reporting in the last 24 hours (target close to 100%).
• Silent source detection time: median minutes from a log source stopping to an alert.
• Impairment alert coverage: share of the TA0112 techniques relevant to your platforms with at least one tested analytic.
• Exclusion hygiene: number of exclusions without an owner or past their expiry.
• Purple team pass rate: share of emulated stealth and impairment behaviours detected within the agreed time, tested under authorised scope. See the Purple Teaming Guide.

Why it matters

Evasion decides dwell time. Every other tactic, from persistence to exfiltration, is easier when the defender is blind or distracted, and an attacker who impairs logging also damages the investigation that follows, which raises recovery cost and weakens regulatory notifications. The Ivanti Connect Secure exploitation shows a related problem: CISA found the vendor's own Integrity Checker Tool failed to detect compromise, so defenders relying on one built-in check were falsely reassured. See the Ivanti Connect Secure exploitation 2024 breach analysis.

Where identity fits

The quietest evasion is legitimate access. ATT&CK lists T1078 Valid Accounts under Stealth because a compromised service account or API key acts with real authority and rarely trips malware analytics. Service accounts that are allowed to change security tooling, audit policy or cloud trails are prime targets for impairment too. Inventory those identities, remove standing rights to alter security configuration, and baseline their behaviour. See the MITRE ATT&CK T1078 Valid Accounts Guide.

Common misconceptions

• "Our EDR stops evasion." EDR is itself a target of T1685. Without tamper protection and silent-source alerting, a disabled agent simply stops reporting, which can look like a quiet day.
• "Log clearing hides everything." Only if logs live solely on the host. Centrally forwarded events survive, and the clearing event itself is high fidelity evidence.
• "Signed means safe." T1218 and T1553 exist precisely because trust decisions based on signatures alone can be abused.
• "Evasion needs advanced malware." Much of it uses built-in tools and valid credentials; the Living off the Land joint guidance from CISA, NSA, NCSC-UK and partners notes many organisations lack the baselines needed to tell this from administration.
• "The old Defense Evasion mapping still works." The old "Impair Defenses" technique is revoked in v20; coverage reports built on it will show gaps or false coverage until remapped. See the MITRE ATT&CK Coverage Mapping Guide.
• "Sandboxes catch evasive malware." T1497 malware that detects analysis environments stays dormant; combine detonation with endpoint behaviour monitoring.

Related concepts

• Living off the land: using built-in tools for malicious ends, the main enabler of stealth.
• Persistence and privilege escalation: evasion usually follows privilege gain, because impairment needs administrative rights. See the Persistence Techniques Guide and Windows Privilege Escalation Techniques Guide.
• Initial access: stealth often starts at the door with valid accounts. See the Initial Access Techniques Guide.
• Threat hunting: hypothesis-led searches are the main way to find stealth that analytics miss. See the Threat Hunting Guide.
• Authorised emulation: red and purple teams test evasion detections under written scope and rules of engagement. See the Red Teaming Guide and Red Team Rules of Engagement Template.
• Malware analysis: reverse engineering explains obfuscation and anti-analysis checks safely in a lab. See the Ghidra for Malware Analysis Guide and the Building a Cybersecurity Home Lab Guide.

Practitioner checklist

• Remap detection content and coverage reports from the revoked Impair Defenses technique to the v20 TA0112 techniques (T1685, T1686, T1689 and others).
• Alert on Security 1102, System 104, Security 4719 and Defender 5001, 5010 and 5012 on every managed Windows host.
• Enable tamper protection centrally and manage antivirus exclusions only through the central tool.
• Forward endpoint, identity and cloud audit logs to a store that host administrators cannot modify.
• Build heartbeat alerts for every critical log source with a defined silence threshold.
• Deploy process lineage and path analytics for masquerading and signed binary proxy execution.
• Remove standing rights for any human or service account to disable security tooling or audit policy.
• Run an authorised purple team exercise each year covering at least five stealth and impairment techniques.

Standards and references

• MITRE ATT&CK: Stealth (TA0005)
• MITRE ATT&CK: Defense Impairment (TA0112)
• MITRE ATT&CK: Disable or Modify Tools (T1685)
• MITRE D3FEND: Process Spawn Analysis
• CISA, NSA, NCSC-UK and partners: Identifying and Mitigating Living Off the Land Techniques
• Microsoft Learn: Protect security settings with tamper protection
• Microsoft Learn: Microsoft Defender Antivirus event IDs and error codes
• Microsoft Learn: Sysmon

Related NHI Mgmt Group resources: EDR Evasion and Defence Guide · Living off the Land Guide · Detection Engineering Guide · Purple Teaming Guide · Penetration Testing Guide