> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/evasion/defense-evasion-introduction.md).

# Defense Evasion - Introduction

The adversary is trying to avoid being detected.

{% hint style="info" %}
Please note that this site is a continuous **work-in-progress!**
{% endhint %}

**Defense Evasion** consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware.

In the MITRE ATT\&CK framework [v19 released in April 2026](https://medium.com/mitre-attack/attack-v19-ff329cb65d66), the Defense Evasion tactic was [split into two](https://medium.com/mitre-attack/defense-evasion-split-5d533545fa32): [Stealth](https://attack.mitre.org/tactics/TA0005) and [Defense Impairment](https://attack.mitre.org/tactics/TA0112).

## Resources

Defense Impairment (TA0112) - Mitre ATT\&CK: <https://attack.mitre.org/tactics/TA0112/>

Stealth (TA0005) - MITRE ATT\&CK: <https://attack.mitre.org/tactics/TA0005/>