Four Attacker Evasion Techniques: Trusted Apps, Infrastructure Abuse, Obfuscation, and Persistence
Summary
An explainer outlines four stealth tactics attackers use: abusing trusted applications and hosted services, concealing malicious activity through obfuscation, and establishing persistence to survive reboots.
Key points
- Trusted application abuse uses legitimate software as a launchpad for malicious activity; fileless malware can manipulate trusted applications rather than install new malware.
- Attackers may use services such as Dropbox or Google Drive as infrastructure, allowing outbound communications to blend in with ordinary traffic.
- Obfuscation conceals malicious behavior, including disguising an executable as a harmless-looking PDF.
- Persistence helps attackers retain access after a system reboot.
Article Details
- Topic
- Four attacker evasion techniques: trusted application abuse, trusted infrastructure abuse, obfuscation, and persistence.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationDescribes concealing malicious code inside an unsuspecting file to make malicious behavior harder to detect.T1036 · MasqueradingDescribes disguising an executable as a harmless PDF to trick a user into opening it.T1102 · Web ServiceDescribes using legitimate hosted services such as Dropbox or Google Drive as part of attack infrastructure.
Products
Dropbox DocSendMuch like trusted application abuse, trusted infrastructure abuse is the act of using legitimate, publicly hosted services and toolsets (such as Dropbox or Google Drive) as part of the attack infrastructure.Google DriveMuch like trusted application abuse, trusted infrastructure abuse is the act of using legitimate, publicly hosted services and toolsets (such as Dropbox or Google Drive) as part of the attack infrastructure.