TA0005 Defense Evasion

The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

View in MITRE ATT&CK®

ATT&CK Techniques

Technique ID Technique Name Number of Mappings Number of Subtechniques
T1006 Direct Volume Access 4 0
T1666 Modify Cloud Resource Hierarchy 7 0
T1014 Rootkit 6 0
T1578 Modify Cloud Compute Infrastructure 22 5
T1600 Weaken Encryption 2 2
T1564 Hide Artifacts 14 12
T1202 Indirect Command Execution 3 0
T1140 Deobfuscate/Decode Files or Information 3 0
T1562 Impair Defenses 47 11
T1036 Masquerading 31 8
T1055 Process Injection 18 12
T1205 Traffic Signaling 19 2
T1218 System Binary Proxy Execution 32 14
T1620 Reflective Code Loading 1 0
T1550 Use Alternate Authentication Material 23 4
T1207 Rogue Domain Controller 1 0
T1610 Deploy Container 26 0
T1112 Modify Registry 7 0
T1535 Unused/Unsupported Cloud Regions 6 0
T1222 File and Directory Permissions Modification 21 2
T1548 Abuse Elevation Control Mechanism 46 6
T1070 Indicator Removal 33 10
T1647 Plist File Modification 18 0
T1542 Pre-OS Boot 39 5
T1612 Build Image on Host 24 0
T1497 Virtualization/Sandbox Evasion 4 3
T1480 Execution Guardrails 2 2
T1601 Modify System Image 38 2
T1574 Hijack Execution Flow 34 13
T1078 Valid Accounts 72 4
T1027 Obfuscated Files or Information 22 14
T1599 Network Boundary Bridging 30 1
T1553 Subvert Trust Controls 35 6
T1197 BITS Jobs 23 0
T1656 Impersonation 1 0
T1221 Template Injection 23 0
T1134 Access Token Manipulation 19 4
T1622 Debugger Evasion 22 0
T1484 Domain or Tenant Policy Modification 22 2
T1220 XSL Script Processing 7 0
T1556 Modify Authentication Process 40 9
T1216 System Script Proxy Execution 8 2
T1211 Exploitation for Defense Evasion 43 0
T1127 Trusted Developer Utilities Proxy Execution 14 2