Techniques › T1211
T1211 Exploitation for Stealth
stealth — Linux, Windows, macOS, SaaS, IaaS · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
4
Sigma rules tagged attack.t1211
1
KEV CVEs mapped here
<p>Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.</p><p>Adversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation occurs when an adversary leverages a programming flaw to execute code in a manner that minimizes visibility or blends in with legitimate activity.</p><p>Rather than directly disabling defenses, adversaries may use exploitation to circumvent monitoring and logging mechanisms. This can include abusing vulnerabilities in logging pipelines, security tools, or cloud infrastructure to evade audit trails, suppress alerts, or operate without generating telemetry.</p><p>Adversaries may identify these opportunities through prior reconnaissance or by performing discovery of security controls after initial access. In some cases, vulnerabilities in SaaS or public cloud environments may be exploited to evade logging, obscure activity, or deploy infrastructure that remains hidden from standard monitoring tools.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2022-21999 | Microsoft Windows | secondary impact | Mapped | 2022-03-25 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0595 Detection Strategy for Exploitation for Stealth v1.0
AN1633 WindowsDetects exploitation attempts targeting defensive security software or OS services. Defender observation includes abnormal process behavior (e.g., AV or EDR crashing unexpectedly), unsigned/untrusted modules loaded into defensive processes, or privilege escalation from security agent services. Multi-event correlation ties exploitation attempts to subsequent evasive behavior like service termination or missing logs.Tunable:
DefensiveProcessListAllowedModulePathsCrashThresholdAN1634 LinuxDetects kernel- or user-space exploitation attempts targeting auditd, AV daemons, or security monitoring agents. Defender observation includes unexpected segfaults, privilege escalation attempts from low-privileged processes, or modifications to security binaries. Correlates exploitation attempts with subsequent gaps in logging or terminated processes.auditd:SYSCALLexecve: Execution of suspicious exploit binaries targeting security daemons→ DC0032 Process Creationlinux:syslogSegfaults, kernel oops, or crashes in security software processes→ DC0038 Application Log ContentTunable:WatchedBinariesCrashPatternsAN1635 macOSDetects exploitation of macOS security and integrity services, such as Gatekeeper, XProtect, or EDR agents. Defender observations include unsigned processes attempting privileged operations, abnormal termination of security daemons, or modification of system integrity logs.macos:unifiedlogAbnormal terminations of com.apple.security.* or 3rd-party security daemons→ DC0038 Application Log Contentmacos:osqueryexecve: Unsigned or unnotarized processes launched with high privileges→ DC0032 Process CreationTunable:SecurityDaemonsUnsignedProcessThresholdAN1636 IaaSDetects exploitation of IaaS cloud security boundaries to evade defense controls. Defender perspective includes anomalous API calls that bypass audit logging, disable monitoring, or manipulate guardrails (e.g., CloudTrail tampering). Correlation highlights when exploitation attempts precede sudden absence of expected telemetry.AWS:CloudTrailStopLogging, DeleteTrail, UpdateTrail: API calls that disable or modify logging services→ DC0038 Application Log ContentTunable:CriticalAPIsTimeWindowAN1637 SaaSDetects adversary abuse of SaaS platform vulnerabilities to bypass logging, monitoring, or consent boundaries. Defender perspective focuses on abnormal application integration events, missing audit logs, or API calls from unauthorized service principals that align with exploitation attempts.m365:unifiedApplicationModified, ConsentGranted: Unexpected app consent or modification events linked to security evasion→ DC0038 Application Log ContentTunable:MonitoredAppsConsentAnomalyThreshold
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1211
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Author: Florian Roth (Nextron Systems)
· 2017-05-09 (modified 2023-04-14) · logsource: product=windows service=application · 545a5da6-f103-4919-a519-e9aec1026ee4
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Author: Florian Roth (Nextron Systems)
· 2017-05-09 (modified 2023-04-14) · logsource: product=windows service=application · 6c82cf5c-090d-4d57-9188-533577631108
This rule detects a suspicious crash of the Microsoft Malware Protection Engine
Author: Sreeman
· 2020-04-21 (modified 2022-03-08) · logsource: product=windows category=process_creation · ae9b0bd7-8888-4606-b444-0ed7410cb728
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.