Cross-source coverage
T1211 / ATT&CK
Exploitation for Stealth
19 rules across 5 sources.
1 atomic-IOC hidden · include
From MITRE ATT&CK 19.2
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
Adversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation occurs when an adversary leverages a programming flaw to execute code in a manner that minimizes visibility or blends in with legitimate activity.
Rather than directly disabling defenses, adversaries may use exploitation to circumvent monitoring and logging mechanisms. This can include abusing vulnerabilities in logging pipelines, security tools, or cloud infrastructure to evade audit trails, suppress alerts, or operate without generating telemetry.
Adversaries may identify these opportunities through prior reconnaissance or by performing discovery of security controls after initial access. In some cases, vulnerabilities in SaaS or public cloud environments may be exploited to evade logging, obscure activity, or deploy infrastructure that remains hidden from standard monitoring tools.
- Tactics
- Stealth
- Platforms
- Linux · Windows · macOS · SaaS · IaaS
- Telemetry
-
WinEventLog:SecurityWinEventLog:Sysmonauditd:SYSCALLlinux:syslogmacos:unifiedlogmacos:osqueryAWS:CloudTrailm365:unified
How MITRE says to detect it DET0595
Detection Strategy for Exploitation for Stealth
Windows Analytic 1633
Detects exploitation attempts targeting defensive security software or OS services. Defender observation includes abnormal process behavior (e.g., AV or EDR crashing unexpectedly), unsigned/untrusted modules loaded into defensive processes, or privilege escalation from security agent services. Multi-event correlation ties exploitation attempts to subsequent evasive behavior like service termination or missing logs.
WinEventLog:SecurityEventCode=4688WinEventLog:SysmonEventCode=7
Linux Analytic 1634
Detects kernel- or user-space exploitation attempts targeting auditd, AV daemons, or security monitoring agents. Defender observation includes unexpected segfaults, privilege escalation attempts from low-privileged processes, or modifications to security binaries. Correlates exploitation attempts with subsequent gaps in logging or terminated processes.
auditd:SYSCALLexecve: Execution of suspicious exploit binaries targeting security daemonslinux:syslogSegfaults, kernel oops, or crashes in security software processes
macOS Analytic 1635
Detects exploitation of macOS security and integrity services, such as Gatekeeper, XProtect, or EDR agents. Defender observations include unsigned processes attempting privileged operations, abnormal termination of security daemons, or modification of system integrity logs.
macos:unifiedlogAbnormal terminations of com.apple.security.* or 3rd-party security daemonsmacos:osqueryexecve: Unsigned or unnotarized processes launched with high privileges
IaaS Analytic 1636
Detects exploitation of IaaS cloud security boundaries to evade defense controls. Defender perspective includes anomalous API calls that bypass audit logging, disable monitoring, or manipulate guardrails (e.g., CloudTrail tampering). Correlation highlights when exploitation attempts precede sudden absence of expected telemetry.
AWS:CloudTrailStopLogging, DeleteTrail, UpdateTrail: API calls that disable or modify logging services
SaaS Analytic 1637
Detects adversary abuse of SaaS platform vulnerabilities to bypass logging, monitoring, or consent boundaries. Defender perspective focuses on abnormal application integration events, missing audit logs, or API calls from unauthorized service principals that align with exploitation attempts.
m365:unifiedApplicationModified, ConsentGranted: Unexpected app consent or modification events linked to security evasion
elastic/protections-artifacts
11 rules| Detection | Severity | Format |
|---|---|---|
| Linux Hidden File Mounted | Undefined | Elastic TOML |
| LSASS Memory Read via PPL Bypass | Undefined | Elastic TOML |
| MacOS Hidden File Mounted | Undefined | Elastic TOML |
| Potential DLL Hollowing from a Writable Image | Undefined | Elastic TOML |
| Potential Exploit via Fake RPC Messages | Undefined | Elastic TOML |
| Potential Protected Process DLL Injection via RPC | Undefined | Elastic TOML |
| Protected Process from Unusual Parent | Undefined | Elastic TOML |
| Protected Process Light Bypass via DLL Tampering | Undefined | Elastic TOML |
| Suspicious DMG File Creation in Tmp Directory | Undefined | Elastic TOML |
| Suspicious Image Load by System Protected Process | Undefined | Elastic TOML |
+ 1 more from elastic/protections-artifacts → showing the 10 highest-severity
SigmaHQ/sigma
4 rules| Detection | Severity | Format |
|---|---|---|
| Audit CVE Event | Critical | Sigma |
| Microsoft Malware Protection Engine Crash | High | Sigma |
| Microsoft Malware Protection Engine Crash - WER | High | Sigma |
| Writing Of Malicious Files To The Fonts Folder | Medium | Sigma |
elastic/detection-rules
2 rules| Detection | Severity | Format |
|---|---|---|
| Potential Defense Evasion via PRoot | High | Elastic TOML |
| Unusual Executable File Creation by a System Critical Process | High | Elastic TOML |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| Application Gateway WAF - SQLi Detection | High | KQL |
splunk/security_content
1 rule| Detection | Severity | Format |
|---|---|---|
| Windows Defender Threat Detected on Kernel Object Path | Undefined | SPL |