Skip to content
Threat Feed
Subscribe

Tag

Defense_evasion

8 briefs RSS
medium advisory

Kubernetes Admission Webhook Created or Modified by Non-System Identity

The creation, modification, or deletion of Kubernetes MutatingWebhookConfigurations or ValidatingWebhookConfigurations by non-system identities can allow attackers to inject malicious sidecars or block security tooling deployments for persistence and defense evasion.

kubernetes persistence defense_evasion
2r 2t
medium advisory

AWS EKS Control Plane Logging Disabled

This rule detects successful Amazon EKS UpdateClusterConfig requests that disable control plane logging, potentially indicating defense evasion via compromised AWS credentials or unauthorized administrative access that reduces visibility into cluster activity.

EKS cloud kubernetes aws defense_evasion
2r 1t
medium advisory

Unusual Service Host Child Process - Childless Service

This detection identifies unusual child processes of Service Host (svchost.exe) that traditionally do not spawn child processes, potentially indicating code injection or exploitation.

m365_defender +3 process_injection privilege_escalation defense_evasion windows
2r 2t
high threat

Scheduled Task Disablement via Schtasks.exe

Detection of the use of schtasks.exe to disable scheduled tasks, a common tactic used by adversaries like IcedID to disable security applications and evade detection, potentially leading to persistence and further system compromise.

Splunk Enterprise +2 IcedID persistence defense_evasion windows
2r
high advisory

O365 Security Feature Modification

Attackers modify or disable Office 365 advanced security settings, such as AntiPhish, SafeLink, SafeAttachment, or Malware policies, to evade detection and operate with reduced risk within the target tenant.

Office 365 +3 o365 email_security defense_evasion persistence
2r 1t
high advisory

O365 MFA Bypassed via Trusted IP Addition

An attacker modifies trusted IP settings in Office 365 to bypass multi-factor authentication (MFA), potentially leading to unauthorized access and data compromise.

Office 365 +3 mfa_bypass o365 defense_evasion
2r 1t
high threat

Malicious Use of Microsoft Intune Device Management Configuration Policies

Attackers can abuse Microsoft Intune device management configuration policies, typically used for legitimate remote device management, to disable defenses and evade detection on managed devices.

exploited Intune azure device_management policy defense_evasion
2r 3t
high threat

AWS S3 Bucket Lifecycle Rule for Rapid Log Deletion

An attacker modifies an AWS S3 bucket lifecycle policy to rapidly expire CloudTrail logs, hindering incident response and forensic analysis.

exploited CloudTrail +4 aws defense_evasion s3
2r 1t