MITRE ATT&CKtactic

TA0030 Defense Evasion

Published 2018-10-17 Modified 2025-04-25 Official page ↗
Domain
mobile
Version
1.0
Created
2018-10-17

Description

The adversary is trying to avoid being detected. Defense evasion consists of techniques an adversary may use to evade detection or avoid other defenses. Sometimes these actions are the same as or variations of techniques in other categories that have the added benefit of subverting a particular defense or mitigation. Defense evasion may be considered a set of attributes the adversary applies to all other phases of the operation.

Related

Referenced by MITRE ATT&CK · tactic (33)

  • T1670 Virtualization Solution technique
  • T1628.003 Conceal Multimedia Files sub-technique
  • T1661 Application Versioning technique
  • T1655 Masquerading technique
  • T1655.001 Match Legitimate Name or Location sub-technique
  • T1628.002 User Evasion sub-technique
  • T1630.003 Disguise Root/Jailbreak Indicators sub-technique
  • T1629 Impair Defenses technique
  • T1629.001 Prevent Application Removal sub-technique
  • T1629.002 Device Lockout sub-technique
  • T1629.003 Disable or Modify Tools sub-technique
  • T1406.001 Steganography sub-technique
  • T1406.002 Software Packing sub-technique
  • T1627 Execution Guardrails technique
  • T1627.001 Geofencing sub-technique
  • T1628 Hide Artifacts technique
  • T1628.001 Suppress Application Icon sub-technique
  • T1630 Indicator Removal on Host technique
  • T1630.001 Uninstall Malicious Application sub-technique
  • T1630.002 File Deletion sub-technique
  • T1631 Process Injection technique
  • T1631.001 Ptrace System Calls sub-technique
  • T1632 Subvert Trust Controls technique
  • T1632.001 Code Signing Policy Modification sub-technique
  • T1633 Virtualization/Sandbox Evasion technique
  • T1633.001 System Checks sub-technique
  • T1617 Hooking technique
  • T1604 Proxy Through Victim technique
  • T1575 Native API technique
  • T1541 Foreground Persistence technique
Show all 33 ›