Simple definition
Defense evasion describes behaviors an attacker uses to avoid security controls, detection or analysis.
Purpose and use
Its purpose is to prolong malicious access or enable an action despite deployed protections.
How does it work?
Behaviors may involve disguising files, concealing activity or making unauthorized changes to a control. The specific mechanism should be described from observed evidence.
Key points
- Example: endpoint protection is disabled outside a planned change, close in time to other suspicious events.
- Correlate the change, responsible account, expected policy and endpoint activity before drawing a conclusion.
Points to watch
Legitimate administration tools can change the same settings. Context and authorization distinguish maintenance from hostile activity.
In short
Defense evasion describes an attacker objective rather than a protective function.