Stealth

TA0005

Tactic.View on attack.mitre.org

About this tactic

The adversary is trying to hide and conceal their actions, appearing as normal behavior.

Stealth consists of techniques that reduce the likelihood of detection by blending in with legitimate activity or minimizing observable signals. These techniques are characterized by concealment behaviors, such as avoiding, obfuscating, or mimicking normal operations, without modifying security controls or compromising collection and monitoring feeds. The goal is to remain indistinguishable from benign activity while leaving defensive systems intact.

Techniques30

IDNameSub-techniquesExamples
T1006Direct Volume Access05
T1014Rootkit032
T1027Obfuscated Files or Information18815
T1036Masquerading12437
T1055Process Injection12239
T1070Indicator Removal8443
T1078Valid Accounts4149
T1127Trusted Developer Utilities Proxy Execution35
T1134Access Token Manipulation567
T1140Deobfuscate/Decode Files or Information0353
T1197BITS Jobs013
T1202Indirect Command Execution04
T1205Traffic Signaling233
T1211Exploitation for Stealth02
T1216System Script Proxy Execution21
T1218System Binary Proxy Execution14230
T1220XSL Script Processing04
T1221Template Injection012
T1480Execution Guardrails280
T1497Virtualization/Sandbox Evasion3153
T1535Unused/Unsupported Cloud Regions00
T1542Pre-OS Boot514
T1564Hide Artifacts14174
T1574Hijack Execution Flow12152
T1612Build Image on Host00
T1620Reflective Code Loading032
T1622Debugger Evasion026
T1678Delay Execution020
T1679Selective Exclusion07
T1684Social Engineering222

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.