Debugger Evasion

Defense Evasion [Mitre]

Adversaries may employ various means to detect and avoid debuggers. Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment. Similar to Virtualization/Sandbox Evasion, if the adversary detects a debugger, …

Deobfuscate/Decode Files or Information

Defense Evasion [Mitre]

Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.

One such example is use of certutil to …

Direct Volume Access

Defense Evasion [Mitre]

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique bypasses Windows file access controls as well as file system monitoring tools.

Utilities, …

Exploitation for Defense Evasion

Defense Evasion [Mitre]

Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.

Impair Defenses: Disable or Modify Tools

Defense Evasion [Mitre]

Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable …

Impair Defenses: Disable Windows Event Logging

Defense Evasion [Mitre]

Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits. Windows event logs record user and system activity such as login attempts, process creation, and much more. This data is used by security tools and analysts to generate detections.

The EventLog service maintains event logs from various system components and applications. By …

Impair Defenses: Impair Command History Logging

Defense Evasion [Mitre]

Adversaries may impair command history logging to hide commands they run on a compromised system. Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

--windows-- The PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default).

Adversaries may …

Impair Defenses: Disable or Modify System Firewall

Defense Evasion [Mitre]

Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage. Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules. This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.

Modifying or disabling a system firewall …

Impair Defenses: Indicator Blocking

Defense Evasion [Mitre]

An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting or even disabling host-based sensors, such as Event Tracing for Windows (ETW), by tampering settings that control the collection and flow of event telemetry. These settings may be stored on the system in configuration files and/or in …

Impair Defenses: Safe Mode Boot

Defense Evasion [Mitre]

Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. …

Search For Content

Search Result

Debugger Evasion

Defense Evasion [Mitre]

Deobfuscate/Decode Files or Information

Defense Evasion [Mitre]

Direct Volume Access

Defense Evasion [Mitre]

Exploitation for Defense Evasion

Defense Evasion [Mitre]

Impair Defenses: Disable or Modify Tools

Defense Evasion [Mitre]

Impair Defenses: Disable Windows Event Logging

Defense Evasion [Mitre]

Impair Defenses: Impair Command History Logging

Defense Evasion [Mitre]

Impair Defenses: Disable or Modify System Firewall

Defense Evasion [Mitre]

Impair Defenses: Indicator Blocking

Defense Evasion [Mitre]

Impair Defenses: Safe Mode Boot

Defense Evasion [Mitre]