TA0005 Defense Evasion

The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.

View in MITRE ATT&CK®

ATT&CK Techniques

Technique ID Technique Name Number of Mappings Number of Subtechniques
T1006 Direct Volume Access 4 0
T1666 Modify Cloud Resource Hierarchy 9 0
T1014 Rootkit 6 0
T1578 Modify Cloud Compute Infrastructure 24 5
T1600 Weaken Encryption 2 2
T1564 Hide Artifacts 18 12
T1202 Indirect Command Execution 4 0
T1140 Deobfuscate/Decode Files or Information 4 0
T1562 Impair Defenses 55 11
T1036 Masquerading 37 9
T1055 Process Injection 19 12
T1205 Traffic Signaling 19 2
T1218 System Binary Proxy Execution 32 14
T1620 Reflective Code Loading 1 0
T1550 Use Alternate Authentication Material 34 4
T1207 Rogue Domain Controller 2 0
T1610 Deploy Container 26 0
T1112 Modify Registry 7 0
T1535 Unused/Unsupported Cloud Regions 8 0
T1222 File and Directory Permissions Modification 21 2
T1548 Abuse Elevation Control Mechanism 50 6
T1070 Indicator Removal 36 10
T1647 Plist File Modification 18 0
T1542 Pre-OS Boot 39 5
T1612 Build Image on Host 24 0
T1497 Virtualization/Sandbox Evasion 4 3
T1480 Execution Guardrails 2 2
T1601 Modify System Image 38 2
T1574 Hijack Execution Flow 35 13
T1078 Valid Accounts 98 4
T1027 Obfuscated Files or Information 26 14
T1599 Network Boundary Bridging 30 1
T1553 Subvert Trust Controls 37 6
T1197 BITS Jobs 23 0
T1656 Impersonation 14 0
T1221 Template Injection 23 0
T1134 Access Token Manipulation 23 4
T1622 Debugger Evasion 22 0
T1484 Domain or Tenant Policy Modification 27 2
T1220 XSL Script Processing 7 0
T1556 Modify Authentication Process 50 9
T1216 System Script Proxy Execution 8 2
T1211 Exploitation for Defense Evasion 44 0
T1127 Trusted Developer Utilities Proxy Execution 15 2