T1211 — Exploitation for Stealth

Tactic: Stealth · Platforms: Linux, Windows, macOS, SaaS, IaaS

Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components. Adversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation…

Sigma detection rules (5)

T1211 Exploitation for Stealth

title: T1211 Exploitation for Stealth
id: bfbae991-55a4-47f0-935a-ad35ba851f62
description: 'Detection Strategy for Exploitation for Stealth. (Data Component: Module Load; baseline tier: windows-eventid.) Tune using: DefensiveProcessList, AllowedModulePaths, CrashThreshold.'
references:
  - https://attack.mitre.org/techniques/T1211
author: Shahrukh Khan
date: 2026-01-18
license: MIT
tags:
  - attack.stealth
  - attack.t1211

logsource:
  category: image_load
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '7'

  selection_target_process:
    Image|endswith:
      - '\MsMpEng.exe'
      - '\NisSrv.exe'
      - '\SenseIR.exe'
      - '\SenseCncProxy.exe'
      - '\SenseSampleUploader.exe'
      - '\lsass.exe'

  selection_unsigned:
    Signed: 'false'

  selection_unusual_path:
    ImageLoaded|contains:
      - '\Users\'
      - '\ProgramData\'
      - '\Temp\'
      - '\AppData\'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_target_process and (selection_unsigned or selection_unusual_path) and not filter_system_account

falsepositives:
  - Third-party AV/EDR plugin DLLs loading into defensive processes from non-standard install paths.

level: medium

T1211 Exploitation for Stealth

title: T1211 Exploitation for Stealth
id: fe161940-5e42-483b-8822-dbd6b98245b6
description: 'Detects invocation of the systemd-coredump handler in the same event as a reference to a security-relevant process name (auditd, rsyslogd/syslog-ng/journald, sshd, fail2ban, falcon-sensor, wazuh-agentd, suricata, snort, osqueryd), which can indicate an adversary exploiting a vulnerability in one of these components to crash it and potentially suppress or evade logging/detection, per T1211. Limitation: auditd telemetry cannot itself confirm a crash was exploit-driven versus an ordinary software fault, cannot see exploitation that leaves no crash at all, and cannot observe exploitation of SaaS/cloud logging pipelines (which T1211 also covers) -- those aspects are not observable via host auditd. This replaces the prior generic any-coredump/segfault-string match, which had no logsource type and fired on routine application crashes. Tune using: WatchedBinaries, CrashPatterns.'
references:
  - https://attack.mitre.org/techniques/T1211
author: Shahrukh Khan
date: 2026-02-06
license: MIT
tags:
  - attack.stealth
  - attack.t1211

logsource:
  category: process_creation
  product: linux

detection:
  selection_coredump:
    type: EXECVE
    exe|endswith: '/systemd-coredump'
  keywords_security_proc:
    - 'auditd'
    - 'rsyslogd'
    - 'syslog-ng'
    - 'journald'
    - 'sshd'
    - 'fail2ban'
    - 'falcon-sensor'
    - 'wazuh-agentd'
    - 'suricata'
    - 'snort'
    - 'osqueryd'

  condition: selection_coredump and keywords_security_proc

falsepositives:
  - Security daemons can crash from resource exhaustion, kernel/library bugs, or misconfiguration unrelated to exploitation; confirming an exploit-driven crash versus an ordinary fault requires crash/core analysis auditd cannot perform.
  - Package upgrades or service restarts that trigger a transient crash-then-restart cycle in a monitored daemon.

level: medium

T1211 Exploitation for Stealth

title: T1211 Exploitation for Stealth
id: 5a6d37ad-26c6-4dd1-909f-3a2ff1a781e3
description: 'Detection Strategy for Exploitation for Stealth. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SecurityDaemons, UnsignedProcessThreshold.'
references:
  - https://attack.mitre.org/techniques/T1211
author: Shahrukh Khan
date: 2026-02-22
license: MIT
tags:
  - attack.stealth
  - attack.t1211

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/syspolicyd'
      - '/trustd'
      - '/securityd'
      - '/tccd'
  condition: selection

falsepositives:
  - The unified log surfaces crashes and restarts of security daemons such as syspolicyd, trustd, and tccd, but distinguishing a genuine exploit-triggered crash from routine daemon restarts during updates requires binary crash-log analysis not available from this event category alone.

level: high

T1211 Exploitation for Stealth

title: T1211 Exploitation for Stealth
id: 2c5005d2-0f5c-49b6-a33a-bc0d92dce8b6
description: 'Detection Strategy for Exploitation for Stealth. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CriticalAPIs, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1211
author: Shahrukh Khan
date: 2026-04-29
license: MIT
tags:
  - attack.stealth
  - attack.t1211

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    errorCode:
      - 'AccessDenied'
      - 'UnauthorizedAccess'
      - 'ValidationError'
  selection_critical_api:
    eventName:
      - 'PutBucketPolicy'
      - 'CreateAccessKey'
      - 'AttachRolePolicy'
      - 'AssumeRole'

  condition: selection and selection_critical_api

falsepositives:
  - Misconfigured automation and permission-boundary testing can produce the same repeated error pattern, and CloudTrail cannot distinguish a genuine exploit attempt from a benign misconfiguration without additional context, so confidence is low.

level: medium

T1211 Exploitation for Stealth

title: T1211 Exploitation for Stealth
id: ff5061b5-d251-498b-859a-193bb1f93b07
description: 'Detection Strategy for Exploitation for Stealth. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: MonitoredApps, ConsentAnomalyThreshold.'
references:
  - https://attack.mitre.org/techniques/T1211
author: Shahrukh Khan
date: 2026-03-02
license: MIT
tags:
  - attack.stealth
  - attack.t1211

logsource:
  product: m365
  service: unified

detection:
  selection:
    Operation:
      - 'Consent to application.'
      - 'Add OAuth2PermissionGrant.'

  condition: selection

falsepositives:
  - Legitimate first-time application consent grants by end users adopting new SaaS tools, since the underlying exploit mechanics of a defense evasion vulnerability are not observable in this log.

level: medium

Explore