Attack scenario
Defense evasion and control impairment
An adversary hides activity, removes evidence, disguises code, or weakens security tools, encryption, firewalls, and recovery mechanisms.
Why this scenario matters
The scenario appears throughout an incident, from obfuscation and code injection to indicator removal and security-control changes. Its goal is to reduce detection probability and extend adversary dwell time.
Protection requires independent telemetry, event correlation, configuration safeguards, control validation, and the ability to recognize when a security control has stopped working.
The scenario uses MITRE ATT&CK® as a reference model. It is an expert SecTec interpretation and does not imply endorsement by MITRE.
Relevant ATT&CK tactics
- Defense Impairment
- Impact
- Privilege Escalation
- Stealth
Relevant ATT&CK techniques
SecTec technologies and vendors
The following hierarchy is derived from the approved ATT&CK-to-technology and technology-to-vendor mappings.