Defense Evasion

What it is

Defense evasion is activity intended to avoid detection or weaken protective controls. It includes tampering with security tools, disabling logs, abusing trusted utilities, or concealing artifacts. It describes an attacker's objective across many techniques, not a single malware family. An apparently quiet dashboard can be unreliable when the telemetry feeding it is compromised.

How it works

The attacker uses existing access to change logging, exclude malicious activity from scanning, or execute through trusted programs. Some methods exploit blind spots without disabling anything. Defenders therefore need evidence from independent sources and alerts when expected signals disappear.

How people get tricked

A signed program or a valid account is treated as proof that an action is authorized. A protection-disable request may be presented as necessary maintenance. Legitimate administration can look similar, so approved changes and context are important.

Example scenario

After a suspicious login, endpoint protection is unexpectedly disabled and no further local alerts arrive. Central identity logs still show unauthorized activity, revealing that silence was not recovery.

Warning signs

• Security controls, exclusions, or logging change without approval.
• Expected telemetry stops or contains unexplained gaps.
• Trusted tools perform unusual tasks under atypical identities.

If it happens to you

Restore controls using a trusted process and investigate the identity and activity behind their changes. Preserve external logs and check what occurred during the gap. Do not assume reenabling protection removes malware or persistence that was introduced while visibility was reduced.