Stealth Malware.

Stealth malware bundles many evasion techniques so that it is invisible to users, security tools and forensic investigators at once: hooking system APIs to hide files and processes, intercepting integrity checks, sandbox and VM detection, anti-debugging, packing and obfuscation, living-off-the-land binaries, timestomping (MITRE ATT&CK T1070.006) and clearing logs after operation. The deeper the code sits, the harder it is to see. TDL-4/TDSS infected the Master Boot Record to load before Windows and hide its own files, while LoJax (ESET, 2018) — attributed to APT28/Sednit — was the first UEFI rootkit found in the wild, surviving OS reinstallation and even disk replacement by living in SPI flash. Stuxnet signed its kernel driver with stolen Realtek and JMicron certificates so it looked legitimate.

Because prevention is imperfect, detection assumes compromise. EDR with kernel-level and memory visibility, off-host tamper-evident logging, network traffic analysis, and threat hunting on TTPs (mapped to MITRE ATT&CK) surface behaviour that files alone hide. Hardening — UEFI Secure Boot, signed/HVCI-enforced drivers, least privilege, and reducing attacker dwell time through proactive hunting — shrinks where stealth malware can live.

flowchart TD
  A[Malware executes] --> B{Environment check}
  B -->|Sandbox / VM / debugger| C[Stay dormant or self-delete]
  B -->|Real target| D[Establish persistence]
  D --> E[Hide: API hooking, rootkit, UEFI/MBR]
  E --> F[Evade: unhook EDR, obfuscate, LOLBins]
  F --> G[Operate: C2, collection]
  G --> H[Anti-forensics: timestomp, clear logs]
  H --> I[Low-and-slow dwell]