TA0005 Defense Evasion

The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

View in MITRE ATT&CK®

ATT&CK Techniques

Technique ID Technique Name Number of Mappings Number of Subtechniques
T1006 Direct Volume Access 4 0
T1666 Modify Cloud Resource Hierarchy 9 0
T1014 Rootkit 6 0
T1578 Modify Cloud Compute Infrastructure 24 5
T1600 Weaken Encryption 2 2
T1564 Hide Artifacts 18 12
T1202 Indirect Command Execution 13 0
T1140 Deobfuscate/Decode Files or Information 6 0
T1562 Impair Defenses 58 11
T1036 Masquerading 39 9
T1055 Process Injection 38 12
T1205 Traffic Signaling 19 2
T1218 System Binary Proxy Execution 34 14
T1620 Reflective Code Loading 1 0
T1550 Use Alternate Authentication Material 34 4
T1207 Rogue Domain Controller 2 0
T1610 Deploy Container 26 0
T1112 Modify Registry 11 0
T1535 Unused/Unsupported Cloud Regions 8 0
T1222 File and Directory Permissions Modification 22 2
T1548 Abuse Elevation Control Mechanism 54 6
T1070 Indicator Removal 39 10
T1647 Plist File Modification 18 0
T1542 Pre-OS Boot 39 5
T1612 Build Image on Host 24 0
T1497 Virtualization/Sandbox Evasion 8 3
T1480 Execution Guardrails 2 2
T1601 Modify System Image 39 2
T1574 Hijack Execution Flow 51 13
T1078 Valid Accounts 144 4
T1027 Obfuscated Files or Information 31 14
T1599 Network Boundary Bridging 30 1
T1553 Subvert Trust Controls 37 6
T1197 BITS Jobs 23 0
T1656 Impersonation 14 0
T1221 Template Injection 26 0
T1134 Access Token Manipulation 23 4
T1622 Debugger Evasion 24 0
T1484 Domain or Tenant Policy Modification 27 2
T1220 XSL Script Processing 7 0
T1556 Modify Authentication Process 53 9
T1216 System Script Proxy Execution 8 2
T1211 Exploitation for Defense Evasion 45 0
T1127 Trusted Developer Utilities Proxy Execution 15 2