Stealth
- ID
- TA0005
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
The adversary is trying to hide and conceal their actions, appearing as normal behavior.
Stealth consists of techniques that reduce the likelihood of detection by blending in with legitimate activity or minimizing observable signals. These techniques are characterized by concealment behaviors, such as avoiding, obfuscating, or mimicking normal operations, without modifying security controls or compromising collection and monitoring feeds. The goal is to remain indistinguishable from benign activity while leaving defensive systems intact.
Techniques (31)
- T1134 Access Token Manipulation
- T1696 Anti-Automation Evasion
- T1197 BITS Jobs
- T1612 Build Image on Host
- T1622 Debugger Evasion
- T1678 Delay Execution
- T1140 Deobfuscate/Decode Files or Information
- T1006 Direct Volume Access
- T1480 Execution Guardrails
- T1211 Exploitation for Stealth
- T1564 Hide Artifacts
- T1574 Hijack Execution Flow
- T1070 Indicator Removal
- T1202 Indirect Command Execution
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1542 Pre-OS Boot
- T1055 Process Injection
- T1620 Reflective Code Loading
- T1014 Rootkit
- T1679 Selective Exclusion
- T1684 Social Engineering
- T1218 System Binary Proxy Execution
- T1216 System Script Proxy Execution
- T1221 Template Injection
- T1205 Traffic Signaling
- T1127 Trusted Developer Utilities Proxy Execution
- T1535 Unused/Unsupported Cloud Regions
- T1078 Valid Accounts
- T1497 Virtualization/Sandbox Evasion
- T1220 XSL Script Processing
