Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components.
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Exploited CVE-2024-20399 in Cisco Switches to which the threat actor was already able to authenticate in order to escape the NX-OS command line interface and gain access to the underlying operating system for arbitrary command execution.1
All 2 groups for this technique
Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.
Technique Campaign use over its cumulative rule count.
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN1633 · Windows
Detects exploitation attempts targeting defensive security software or OS services. Defender observation includes abnormal process behavior (e.g., AV or EDR crashing unexpectedly), unsigned/untrusted modules loaded into defensive processes, or privilege escalation from security agent services. Multi-event correlation ties exploitation attempts to subsequent evasive behavior like service termination or missing logs.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Module LoadDC0016 | WinEventLog: | EventCode= |
| Process CreationDC0032 | WinEventLog: | EventCode= |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| DefensiveProcessList | List of defensive services/processes (e.g., AV, EDR) monitored in the environment. |
| AllowedModulePaths | Whitelisted DLL/module paths normally loaded by defensive tools. |
| CrashThreshold | Number of abnormal terminations of defensive processes tolerated before triggering an alert. |
AN1634 · Linux
Detects kernel- or user-space exploitation attempts targeting auditd, AV daemons, or security monitoring agents. Defender observation includes unexpected segfaults, privilege escalation attempts from low-privileged processes, or modifications to security binaries. Correlates exploitation attempts with subsequent gaps in logging or terminated processes.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd: | execve: |
| Application Log ContentDC0038 | linux: | Segfaults, kernel oops, or crashes in security software processes |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WatchedBinaries | List of critical security daemons (e.g., auditd, falco, AV agents) to monitor for exploitation. |
| CrashPatterns | Regex or patterns for kernel/syslog errors correlated with exploitation attempts. |
AN1635 · macOS
Detects exploitation of macOS security and integrity services, such as Gatekeeper, XProtect, or EDR agents. Defender observations include unsigned processes attempting privileged operations, abnormal termination of security daemons, or modification of system integrity logs.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | macos: | execve: |
| Application Log ContentDC0038 | macos: | Abnormal terminations of com.apple.security.* or 3rd-party security daemons |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SecurityDaemons | Monitored Apple and third-party EDR/AV daemon names. |
| UnsignedProcessThreshold | Number of unsigned high-privilege executions before alerting. |
AN1636 · IaaS
Detects exploitation of IaaS cloud security boundaries to evade defense controls. Defender perspective includes anomalous API calls that bypass audit logging, disable monitoring, or manipulate guardrails (e.g., CloudTrail tampering). Correlation highlights when exploitation attempts precede sudden absence of expected telemetry.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | AWS: | StopLogging, DeleteTrail, UpdateTrail: |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CriticalAPIs | List of sensitive cloud API operations that should be rare and tightly monitored. |
| TimeWindow | Duration for correlation of API exploitation with sudden logging gaps. |
AN1637 · SaaS
Detects adversary abuse of SaaS platform vulnerabilities to bypass logging, monitoring, or consent boundaries. Defender perspective focuses on abnormal application integration events, missing audit logs, or API calls from unauthorized service principals that align with exploitation attempts.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | m365: | ApplicationModified, ConsentGranted: |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredApps | Applications and integrations expected in the environment; deviations may be suspect. |
| ConsentAnomalyThreshold | Threshold for anomalous OAuth or app consent events before flagging exploitation. |
Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in these systems may still exist.
Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. Many of these protections depend on the architecture and target application binary for compatibility and may not work for software targeted for defense evasion.
Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.
Update software regularly by employing patch management for internal enterprise endpoints and servers.
5 rules are mapped to this technique.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited. (...) | Generic | test | - | windows | WinEventLog Application | critical | Florian Roth (Nextron Systems), Zach Mathis | 2020-01-15 | 2022-10-22 | 48d91a3a-2363-43ba-a456-ca71ac3da5c2 | |||||
This rule detects a suspicious crash of the Microsoft Malware Protection Engine | Generic | test | - | windows | WinEventLog Application | - | high | Florian Roth (Nextron Systems) | 2017-05-09 | 2023-04-14 | 545a5da6-f103-4919-a519-e9aec1026ee4 | ||||
This rule detects a suspicious crash of the Microsoft Malware Protection Engine | Generic | test | - | windows | WinEventLog Application | - | high | Florian Roth (Nextron Systems) | 2017-05-09 | 2023-04-14 | 6c82cf5c-090d-4d57-9188-533577631108 | ||||
Splunk | The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot\). (...) | Generic | stable | process_creation | windows | Windows Defender | - | medium | Onur Mustafa Erdogan, Splunk | 2026-08-17 | 2026-08-18 | 702631e8-90ce-43db-90fd-cf0228edc8ad | |||
Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Sreeman | 2020-04-21 | 2022-03-08 | ae9b0bd7-8888-4606-b444-0ed7410cb728 |