Stealth (30 techniques)
Hiding activity by blending in with legitimate behavior: obfuscating, avoiding, or mimicking normal operations.
The Stealth tactic groups MITRE ATT&CK techniques used by adversaries tohiding activity by blending in with legitimate behavior: obfuscating, avoiding, or mimicking normal operations. Each technique below has its own page with detection guidance, platforms, and sub-techniques.
- T1006 - Direct Volume AccessNetwork Devices, Windows
- T1014 - RootkitLinux, macOS, Windows
- T1027 - Obfuscated Files or InformationESXi, Linux, macOS, Network Devices, Windows
- T1036 - MasqueradingContainers, ESXi, Linux, macOS, Windows
- T1055 - Process InjectionLinux, macOS, Windows
- T1070 - Indicator RemovalContainers, ESXi, Linux, macOS, Network Devices, Office Suite, Windows
- T1078 - Valid AccountsContainers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows
- T1127 - Trusted Developer Utilities Proxy ExecutionWindows
- T1134 - Access Token ManipulationWindows
- T1140 - Deobfuscate/Decode Files or InformationESXi, Linux, macOS, Windows
- T1197 - BITS JobsWindows
- T1202 - Indirect Command ExecutionWindows
- T1205 - Traffic SignalingLinux, macOS, Network Devices, Windows
- T1211 - Exploitation for StealthLinux, Windows, macOS, SaaS, IaaS
- T1216 - System Script Proxy ExecutionWindows
- T1218 - System Binary Proxy ExecutionLinux, macOS, Windows
- T1220 - XSL Script ProcessingWindows
- T1221 - Template InjectionWindows
- T1480 - Execution GuardrailsESXi, Linux, macOS, Windows
- T1497 - Virtualization/Sandbox EvasionLinux, macOS, Windows
- T1535 - Unused/Unsupported Cloud RegionsIaaS
- T1542 - Pre-OS BootLinux, macOS, Network Devices, Windows
- T1564 - Hide ArtifactsESXi, Linux, macOS, Office Suite, Windows
- T1574 - Hijack Execution FlowLinux, macOS, Windows
- T1612 - Build Image on HostContainers
- T1620 - Reflective Code LoadingLinux, macOS, Windows
- T1622 - Debugger EvasionLinux, macOS, Windows
- T1678 - Delay ExecutionLinux, macOS, Windows
- T1679 - Selective ExclusionWindows
- T1684 - Social EngineeringLinux, macOS, Office Suite, SaaS, Windows
Detection engineering training, taught by practitioners.
Learn how to build real detections across the MITRE ATT&CK framework.
View Courses