What Defense Evasion Means and Why It Matters to Defenders
Summary
An introductory explainer describes how attackers evade security tools and manipulate users or investigators, and why understanding these tactics helps defenders improve their defenses.
Key points
- Defense evasion encompasses attempts to avoid detection by security tools, users, and investigators.
- Examples include fileless malware, disabling security tools, modifying malware to bypass defenses, and abusing legitimate functionality.
- Attackers may also use phishing, impersonation, or misleading forensic clues to manipulate people and frustrate investigations.
- The article says understanding adversary tradecraft can help defenders strengthen detections and defenses.
- Huntress co-founder John Ferrell says attackers often favor effective, lower-cost approaches such as living off the land or tricking someone with administrator credentials over complex kernel-space tools.
- The author notes growing research into kernel-level evasion, including techniques involving ETW and system calls.
Article Details
- Topic
- Defense evasion techniques and their use in cyber attacks
People
Dray AghaAuthor of the article discussing defense evasion.Florian RothCredited with reactive Sigma rules for novel tradecraft.John FerrellHuntress co-founder quoted on attacker use of defense evasion.John HammondHuntress colleague whose discussion of reverse engineering is referenced.Matthew BrennanColleague whose blog on evasion is referenced.
Vendors
Products
Event Tracing for Windows (ETW)that computers are all about. When I see threat actors deploying techniques that undermine Event Tracing for Windows (ETW), a staple source of telemetry for many security solutions, or when I see research onMicrosoft 365 Apps for EnterpriseOur platform combines a suite of powerful managed detection and response tools for endpoints and Microsoft 365 identities, science-backed security awareness training, and the expertise of our 24/7 Security OperationsSigmamatch their creativity with our own creative rebuttals. Florian Roth embodies this best with his reactive Sigma rules to novel tradecraft.