Full Report
An introduction to defense evasion as an attack tactic. Read on to explore what defense evasion is and why it’s important to understand how it’s used.
Analysis Summary
# Tool/Technique: Defense Evasion
## Overview
Defense evasion is a strategic attack tactic encompassing a wide range of techniques used by threat actors to avoid detection during a malicious campaign. Its primary purpose is to bypass security controls, remain hidden on a network for as long as possible, and frustrate forensic analysis or incident response efforts.
## Technical Details
- **Type**: Technique (MITRE ATT&CK Tactic)
- **Platform**: Windows, macOS, Linux, Cloud, and Human (Psychological)
- **Capabilities**: Hiding malicious presence, disabling security software, obfuscating code, and manipulating forensic artifacts.
- **First Seen**: N/A (Fundamental concept in cyber attacks)
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- **T1070.006 - Indicator Removal on Host: Timestomping**: Manipulating file timestamps to blend in with legitimate system files.
- **T1027 - Obfuscated Files or Information**: Using layers of packing or encryption to frustrate reverse engineering.
- **T1562.001 - Impair Defenses: Disable or Modify Tools**: Turning off Antivirus (AV) or Endpoint Detection and Response (EDR) agents.
- **T1036 - Masquerading**: Using legitimate-looking filenames or syntax to bypass psychological and technical safeguards.
- **T1620 - Reflective Code Loading**: Deploying "file-less" malware that operates only in-memory.
## Functionality
### Core Capabilities
- **Security Tool Impairment**: Directly disabling or modifying security solutions like Windows Defender or EDR listeners.
- **Stealth Execution**: Utilizing file-less malware techniques to operate in-memory and avoid leaving a footprint on the physical disk.
- **Signature Mutation**: Brute-forcing security solutions by constantly mutating malware variants until one bypasses signature-based detection.
### Advanced Features
- **Cognitive/Psychological Evasion**: Using Social Engineering to bypass the "human firewall," such as masquerading as security researchers or using familiar branding in phishing.
- **Anti-Forensics**: Including numerous layers of obfuscation to exhaust reverse engineers and using "Timestomping" to deceive investigators regarding the timeline of an attack.
- **User-land/Kernel-land Subversion**: Undermining the hooks and listeners that security products use to monitor system activity.
## Indicators of Compromise
- **File Hashes**: N/A (Technique-based; varies by tool)
- **File Names**: Often mimic legitimate system files or software (e.g., `svchost.exe` in incorrect directories).
- **Registry Keys**: Keys associated with disabling security features (e.g., `HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware`).
- **Network Indicators**: C2 communication hidden via legitimate services (e.g., `discordapp[.]com`, `github[.]com`) or NoVNC for 2FA bypass.
- **Behavioral Indicators**:
- Unexpected clearing of Event Logs (`wevtutil cl`).
- Sudden cessation of security agent heartbeats.
- Process hollowing or reflective injection into legitimate processes.
## Associated Threat Actors
- **The Gentlemen (Ransomware group)**: Known for clearing logs and adding AV exclusions.
- **Lazarus Group (North Korean activity)**: Known for masquerading as security researchers on social media to deliver malware.
- **3CX Supply Chain Actors**: Utilized sophisticated multi-stage defense evasion.
## Detection Methods
- **Behavioral Detection**: Monitoring for the suspension of security processes or the use of tools like "Defender Control."
- **Heuristic Analysis**: Identifying anomalies in file metadata, such as inconsistent MFT (Master File Table) timestamps (Timestomping detection).
- **Memory Scanning**: Scanning for unbacked executable code or suspicious memory allocations (e.g., `PAGE_EXECUTE_READWRITE`).
## Mitigation Strategies
- **Least Privilege**: Prevent users and compromised processes from having the permissions required to disable security software.
- **Tamper Protection**: Enable vendor-specific "Tamper Protection" features that prevent services from being stopped even by administrative users.
- **Hardening**: Use Attack Surface Reduction (ASR) rules to block process injection and unauthorized changes to system files.
## Related Tools/Techniques
- **Living off the Land (LotL)**: Using legitimate binaries (LOLBins) to perform malicious actions.
- **Phishing**: Often used as the delivery mechanism for psychological evasion.
- **Packers/Crypters**: Used to automate the mutation of malware signatures.