Home TacticsDefense Evasion

ATT&CK Tactics

Tactics represent the "why" of an ATT&CK technique. They are the adversary's tactical goals: the reason for performing an action. There are 14 tactics in the Enterprise ATT&CK Matrix.

TA0043

TA0005

Defense Evasion

The adversary is trying to avoid being detected. Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise.

Associated Techniques(34)

T1140

Deobfuscate/Decode Files or Information

Adversaries may use obfuscated files or information to hide artifacts of an intrusion from analysis.

T1006

Direct Volume Access

Adversaries may directly access a volume to bypass file access controls and file system monitoring.

T1480

Execution Guardrails

Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions.

2 sub-techniques

T1211

Exploitation for Defense Evasion

Adversaries may exploit a system or application vulnerability to bypass security features.

T1222

File and Directory Permissions Modification

Adversaries may modify file or directory permissions/attributes to evade access control lists.

2 sub-techniques

T1564

Hide Artifacts

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

14 sub-techniques

T1562

Impair Defenses

Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

12 sub-techniques

T1070

Indicator Removal

Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence.

10 sub-techniques

T1036

Masquerading

Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign.

12 sub-techniques

T1027

Obfuscated Files or Information

Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents.

17 sub-techniques

T1014

Rootkit

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

T1218

System Binary Proxy Execution

Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed binaries.

15 sub-techniques

T1497

Virtualization/Sandbox Evasion

Adversaries may employ various means to detect and avoid virtualization and analysis environments.

3 sub-techniques

T1202

Indirect Command Execution

Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

T1207

Rogue Domain Controller

Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data using DCShadow.

T1216

System Script Proxy Execution

Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files.

2 sub-techniques

T1220

XSL Script Processing

Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files.

T1221

Template Injection

Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

T1553

Subvert Trust Controls

Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

6 sub-techniques

T1112

Modify Registry

Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques.

T1127

Trusted Developer Utilities Proxy Execution

Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads.

1 sub-techniques

T1535

Unused/Unsupported Cloud Regions

Adversaries may create cloud instances in unused geographic service regions in order to evade detection.

T1550

Use Alternate Authentication Material

Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens.

4 sub-techniques

T1078

Valid Accounts

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

4 sub-techniques

T1620