Overview: Defense Evasion

Quick Definition

Defense evasion refers to techniques used by attackers to avoid detection by security controls and monitoring systems. These methods allow malicious actors to maintain persistence, execute payloads, and achieve their objectives while remaining hidden from defensive measures.

Common defense evasion techniques include process injection, where malware injects code into legitimate processes to appear benign; file masquerading, which involves disguising malicious files as trusted applications; and timestomping, where attackers modify file timestamps to blend in with existing system files. Attackers may also disable security tools, clear event logs, use legitimate administrative tools for malicious purposes (living off the land), or employ obfuscation techniques to hide their code.

These techniques are particularly dangerous because they exploit the trust relationships and normal operations within a system. By mimicking legitimate behavior or hiding within trusted processes, attackers can operate undetected for extended periods, allowing them to steal data, establish persistence, or move laterally through networks. Organizations must implement layered security approaches, including behavioral analysis and continuous monitoring, to effectively counter defense evasion attempts.