ATT&CK technique
View on MITRE ATT&CK →
T1211
Exploitation for Stealth
Stealth
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Potential Defense Evasion via PRoot | production | 2026-09-18 |
| elastic | Unusual Executable File Creation by a System Critical Process | production | 2026-09-18 |
| splunk | Windows Defender Threat Detected on Kernel Object Path | production | 2026-08-18 |
| sigma | Microsoft Malware Protection Engine Crash | test | 2023-04-14 |
| sigma | Microsoft Malware Protection Engine Crash - WER | test | 2023-04-14 |
| sigma | Audit CVE Event | test | 2022-10-22 |
| sigma | Writing Of Malicious Files To The Fonts Folder | test | 2022-03-08 |
| sentinel | Application Gateway WAF - SQLi Detection | Scheduled | — |