Exploitation for Stealth (MITRE ATT&CK T1211) is the use of vulnerabilities to evade detection by hiding activity, suppressing logging, or working inside trusted or unmonitored components. MITRE files it under Stealth and lists IaaS, Linux, SaaS, Windows and macOS.
How attackers use it
An attacker exploits a flaw in a system or application to avoid detection while keeping access. Rather than switching defenses off, they use a flaw to get around monitoring and logging. That can mean abusing weaknesses in logging pipelines, security tools or cloud infrastructure to evade audit trails, suppress alerts, or work without generating telemetry. They may find these openings through earlier reconnaissance or by discovering security controls after initial access. In SaaS and public cloud, flaws may be used to evade logging or to deploy hidden infrastructure.
The MITRE page lists an escape from the command line interface of a network switch into the underlying operating system, and a bypass of security features using a known vulnerability.
How to detect it
MITRE's detection strategy looks for exploitation of defensive software and for missing telemetry afterward.
- Windows. Antivirus or EDR crashing unexpectedly, unsigned or untrusted modules loaded into defensive processes, or privilege escalation from security agent services, followed by service termination or missing logs.
- Linux. Unexpected segfaults in auditd, antivirus daemons or monitoring agents, escalation attempts from low-privileged processes, and changes to security binaries, followed by gaps in logging.
- macOS. Unsigned processes attempting privileged operations, abnormal termination of Gatekeeper, XProtect or EDR daemons, and changes to system integrity logs.
- IaaS. Unusual API calls that bypass audit logging, disable monitoring or alter guardrails, such as tampering with CloudTrail, and a sudden absence of expected telemetry.
- SaaS. Odd application integration events, missing audit logs, or API calls from unauthorized service principals.
The best control signal is silence. Alert when a host or account that normally produces logs stops doing so. Read-only checks include auditctl -s on Linux for audit status, and aws cloudtrail get-trail-status for a trail.
How to reduce the risk
MITRE's mitigations: sandbox and isolate applications, use exploit protection tools, run a threat intelligence program, and patch internal endpoints and servers regularly. Keep security agents themselves in the patch plan.
Quick check
What is the strongest signal of this technique?
A sudden absence of expected telemetry, such as a security agent crashing, a log source going quiet, or audit logging being bypassed.
