Stealth is adversary behaviour designed to blend into normal activity and avoid detection. In ATT&CK v19, it separates concealment from direct control degradation, giving defenders a clearer way to test whether visibility controls can still identify suspicious behaviour without assuming the attacker is trying to break tooling.
What Stealth Means in Adversary Tradecraft
Stealth is not a single technique so much as a behaviour pattern: the attacker tries to look ordinary, reduce noisy actions, and move in ways that do not stand out in logs or analyst workflows. That makes it a detection problem as much as an intrusion problem, because success depends on whether normal baselines still reveal the abnormal sequence.
How Stealth Differs From Simple Evasion
Stealth focuses on blending in. Evasion can include breaking sensors, disabling tools, or directly degrading controls, but stealth does not require that. A stealthy actor may use valid credentials, ordinary protocols, standard admin paths, or low-and-slow activity that stays inside expected thresholds. In other words, the defender is not only looking for broken tooling, but for behaviour that should have been visible and was not.
Why Stealth Matters for Detection Engineering
Stealth is dangerous because it exploits the gap between what a control records and what an analyst is able to distinguish. If detection rules depend too heavily on obvious anomalies, a patient actor can remain present while still looking like background activity. That is why stealth testing is useful: it exposes whether telemetry, correlation, and alert tuning can identify suspicious behaviour even when nothing overtly malicious is happening.
Defenders usually need layered visibility to catch it, including identity signals, endpoint and network telemetry, and correlation across time. The practical question is whether the environment can tell the difference between legitimate administrative work and activity that merely resembles it.
Where Stealth Shows Up in an Attack Lifecycle
Stealth is often most valuable after initial access, when the goal shifts from getting in to staying useful without being noticed. It can support reconnaissance, lateral movement, privilege abuse, collection, and persistence by keeping activity within acceptable-looking bounds. That means stealth is not just about hiding one event, but about preserving the attacker's freedom of action over time.
Because it is a behavioural property, stealth can appear across many techniques rather than as one fixed step. Defenders should therefore think in terms of observable patterns, not just named tactics, and ask whether the environment can surface suspicious sequencing, frequency, source changes, or access patterns that remain individually plausible but collectively concerning.
Risk and Threat Considerations
Stealth raises the risk that an attacker will remain undetected long enough to expand access, exfiltrate data, or stage later actions from a trusted foothold. The danger is not only hidden presence, but the false confidence that comes from seeing activity that looks routine.
Failure mechanism: Detection controls miss or deprioritise attacker activity because it resembles legitimate user, admin, or service behaviour, especially when the actor keeps actions slow, sparse, and within normal-looking bounds.
Impact: Compromise can last longer, investigation starts later, and the eventual blast radius is often larger because the attacker has had more time to blend into normal operations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0005 — Defense Evasion | Stealth is an adversary behaviour used to avoid detection and blend into normal activity. |
| Recommendation — Map suspicious low-noise activity to Defense Evasion and tune detections for blending and concealment patterns. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for anomalies and events | Stealth directly tests whether continuous monitoring can still surface abnormal behaviour. |
| DE.AE-02 — Anomalous activity is analyzed to understand the event | Stealth matters because suspicious behaviour may look ordinary until analysts correlate context. | |
| Recommendation — Hunt for subtle outliers in your monitoring pipeline and validate that normal-looking activity still triggers review. Correlate weak signals across time and sources to distinguish benign routine work from covert attacker activity. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Stealth exploits gaps between logging and analyst review, making audit analysis central. |
| DE.CM-01 — Monitoring for anomalies and events | Stealth depends on remaining visible enough for monitoring to detect despite disguise. | |
| Recommendation — Review audit records for low-and-slow patterns and investigate sequences that resemble normal admin work. Baseline normal activity and alert on subtle deviations that indicate covert behaviour. | ||
Practitioner Guidance
What to watch for: Treat stealth as a measurement problem, not just a threat label. The useful question is whether your telemetry can correlate behaviour over time, across hosts, identities, and sessions, and still surface the small differences that separate ordinary administration from suspicious activity.
Practitioner note: When teams test for stealth, they should validate both the signal quality and the analyst workflow, because a technically visible event is still ineffective if it is buried by weak correlation, poor baselining, or alert fatigue.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org