Exploitation for Defense Evasion

Info

ID:
Tactic: Deepening Control

Exploitation for Defense Evasion

Adversaries may exploit how the target operating system or runtime environment monitors processes, memory, and filesystem operations to remain undetected. Techniques include injecting code into legitimate processes, using ptrace system calls to alter runtime behavior, or abusing reflective loading to hide malicious modules. This avoids simple signature‑based detection and complicates incident response by blending with normal system functions.

Cloud and container platforms often incorporate monitoring agents and logs for security visibility, but adversaries who exploit these to bypass or disable checks can achieve prolonged stealth. Successfully evading defenses grants attackers more time to pivot through the environment, exfiltrate data, or embed deeper persistence. This method typically appears alongside other advanced tactics, since an unnoticed intrusion is essential for broad compromise.