t1211-exploitation-for-defense-evasion

name	T1211_exploitation-for-defense-evasion
description	Adversaries may exploit a system or application vulnerability to bypass security features.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1211","defense-evasion","linux","windows","macos","saas","iaas"]
technique_id	T1211
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Linux","Windows","macOS","SaaS","IaaS"]
mitre_url	https://attack.mitre.org/techniques/T1211
tech_stack	["linux","windows","macos","saas","cloud"]
cwe_ids	["CWE-693"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1211 Exploitation for Defense Evasion

High-Level Description

Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.

Adversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for Security Software Discovery. The security software will likely be targeted directly for exploitation. There are examples of antivirus software being targeted by persistent threat groups to avoid detection.

There have also been examples of vulnerabilities in public cloud infrastructure of SaaS applications that may bypass defense boundaries , evade security logs , or deploy hidden infrastructure.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Linux, Windows, macOS, SaaS, IaaS

What to Check

• Identify if Exploitation for Defense Evasion technique is applicable to target environment
• Check Linux systems for indicators of Exploitation for Defense Evasion
• Check Windows systems for indicators of Exploitation for Defense Evasion
• Check macOS systems for indicators of Exploitation for Defense Evasion
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Manual Testing

1. Identify Attack Surface: Determine if the target environment is susceptible to Exploitation for Defense Evasion by examining the target platforms (Linux, Windows, macOS).

2. Assess Existing Defenses: Review whether mitigations for T1211 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Note: No Atomic Red Team tests available for this technique. See for updates.