Full Report
Learn about four of the most prominent attacker evasion techniques that hackers use—and how you can defend your environments against them.
Analysis Summary
# Tool/Technique: Attacker Evasion Techniques (Stealth & Persistence)
## Overview
This entry summarizes four primary evasion strategies used by modern threat actors to maintain a low profile, bypass security controls, and ensure long-term access to compromised environments. The shift from "loud" attacks to these stealthy methods allows attackers to conduct long-term operations without triggering traditional alerts.
## Technical Details
- **Type:** Technique (Defense Evasion & Persistence)
- **Platform:** Primarily Windows (applicable to macOS/Linux via similar methods)
- **Capabilities:** Application hijacking, traffic masking, code concealment, and reboot survival.
- **First Seen:** Continuous evolution; concepts popularized with the rise of Advanced Persistent Threats (APTs).
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- T1218 - System Binary Proxy Execution (Trusted Application Abuse)
- T1027 - Obfuscated Files or Information
- T1564.001 - Hidden Files and Directories
- **TA0003 - Persistence**
- T1547 - Boot or Logon Autostart Execution
- **TA0011 - Command and Control**
- T1102 - Web Service (Trusted Infrastructure Abuse)
## Functionality
### Core Capabilities
* **Trusted Application Abuse:** Utilizing legitimate, pre-installed system tools or software to run malicious code (Living off the Land). This avoids the need to drop new, untrusted executables onto the disk.
* **Trusted Infrastructure Abuse:** Leveraging known public services (e.g., Dropbox, Google Drive) for C2 communication or payload delivery, as these domains are rarely blocked by corporate firewalls.
* **Obfuscation:** Disguising malicious intent through techniques like file extension masquerading (e.g., naming an executable `report.pdf.exe`) or encrypting/encoding scripts to bypass static signature analysis.
* **Persistence:** Implementing mechanisms to ensure malicious access survives system reboots or user logoffs.
### Advanced Features
* **Fileless Malware:** Executing code directly in memory using hijacked trusted processes (e.g., PowerShell or WMI) so that no artifacts remain on the physical disk for traditional antivirus to scan.
* **Living off the Land (LotL):** Using signed binaries like `certutil.exe` or `mshta.exe` to download or execute payloads, making malicious activity look like routine administrative tasks.
## Indicators of Compromise
* **File Names:** Common masquerading examples like `invoice.pdf.exe` or `zoom_update.exe`.
* **Registry Keys:** Modifications to `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` or `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce`.
* **Network Indicators:** Unusually high traffic to legitimate cloud storage domains:
* `dropbox[.]com`
* `drive.google[.]com`
* **Behavioral Indicators:**
* PowerShell processes spawning with long, encoded command lines (`-EncodedCommand`).
* Legitimate applications (like `explorer.exe` or `svchost.exe`) making external network connections they do not typically require.
* Unexpected use of system tools like `vssadmin.exe` (often used to delete backups).
## Associated Threat Actors
* **Scattered Spider** (Known for identity-based attacks and infrastructure abuse).
* General APT groups and Ransomware-as-a-Service (RaaS) affiliates.
## Detection Methods
* **Behavioral Detection:** Monitoring for process parent-child relationship anomalies (e.g., `word.exe` spawning `powershell.exe`).
* **Command Line Logging:** Enabling Enhanced PowerShell Logging (Script Block Logging) to capture de-obfuscated code.
* **Network Analysis:** Identifying anomalous volume or timing of traffic to trusted cloud providers.
* **EDR/MDR:** Utilizing Endpoint Detection and Response tools to track "Persistence" triggers such as new registry autoruns or scheduled tasks.
## Mitigation Strategies
* **Application Whitelisting/Control:** Restrict the execution of non-essential administrative tools for standard users.
* **Principle of Least Privilege:** Limit user permissions to prevent the creation of persistent registry keys or scheduled tasks.
* **File Extension Visibility:** Ensure Windows is configured to "Show file extensions" by default to prevent masquerading tricks.
* **Network Segmentation:** Restrict access to cloud storage providers to only those users who require it for business functions.
## Related Tools/Techniques
* **Living off the Land Binaries (LoLBins)**
* **Process Injection**
* **DLL Side-Loading**