MITRE ATT&CKtactic
TA0005 Stealth
- Domain
- enterprise
- Version
- 1.0
- Created
- 2018-10-17
Description
The adversary is trying to hide and conceal their actions, appearing as normal behavior.
Stealth consists of techniques that reduce the likelihood of detection by blending in with legitimate activity or minimizing observable signals. These techniques are characterized by concealment behaviors, such as avoiding, obfuscating, or mimicking normal operations, without modifying security controls or compromising collection and monitoring feeds. The goal is to remain indistinguishable from benign activity while leaving defensive systems intact.
Related
Referenced by MITRE ATT&CK · tactic (151)
- T1696.001 Automate CAPTCHA Completion sub-technique
- T1696.002 Avoid CAPTCHA sub-technique
- T1696 Anti-Automation Evasion technique
- T1027.018 Invisible Unicode sub-technique
- T1684 Social Engineering technique
- T1684.001 Impersonation sub-technique
- T1684.002 Email Spoofing sub-technique
- T1679 Selective Exclusion technique
- T1678 Delay Execution technique
- T1036.012 Browser Fingerprint sub-technique
- T1036.011 Overwrite Process Arguments sub-technique
- T1564.014 Extended Attributes sub-technique
- T1027.017 SVG Smuggling sub-technique
- T1127.003 JamPlus sub-technique
- T1027.015 Compression sub-technique
- T1027.016 Junk Code Insertion sub-technique
- T1564.013 Bind Mounts sub-technique
- T1027.014 Polymorphic Code sub-technique
- T1480.002 Mutual Exclusion sub-technique
- T1127.002 ClickOnce sub-technique
- T1036.010 Masquerade Account Name sub-technique
- T1070.010 Relocate Malware sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1564.012 File/Path Exclusions sub-technique
- T1574.014 AppDomainManager sub-technique
- T1218.015 Electron Applications sub-technique
- T1216.002 SyncAppvPublishingServer sub-technique
- T1027.012 LNK Icon Smuggling sub-technique
- T1036.009 Break Process Trees sub-technique
- T1564.011 Ignore Process Interrupts sub-technique