Defense Evasion.

The MITRE ATT&CK tactic (TA0005) covering techniques attackers use to avoid detection, disable security tools, and hide their activity on a target system. It belongs to the Defense & Operations category of cybersecurity.

The MITRE ATT&CK tactic (TA0005) covering techniques attackers use to avoid detection, disable security tools, and hide their activity on a target system.

Defense Evasion (MITRE ATT&CK tactic TA0005) groups techniques designed to bypass, blind, or fool security controls. It is one of the largest tactics in the matrix and includes obfuscated and encrypted payloads, process injection, DLL side-loading, signed-binary proxy execution (LOLBins), disabling or uninstalling EDR/AV, clearing event logs, masquerading as legitimate processes, abusing trusted directories, and using rootkits or BYOVD (Bring Your Own Vulnerable Driver) attacks. Defense Evasion is often interleaved with other tactics throughout an intrusion. Defenders counter it with kernel-level telemetry, EDR tamper protection, immutable logging, signed-binary inventory monitoring, and behavioural detections that look at intent and chains of activity rather than individual signatures.

Defences for Defense Evasion typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Defence Evasion, TA0005.