{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1211","id":"T1211","name":"Exploitation for Stealth","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1211","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"98645785dd63316ba15bcc04ea75819d1d7eacde7e8cffe28c0690b8c07e65cd","description":"Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components. \n\nAdversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation occurs when an adversary leverages a programming flaw to execute code in a manner that minimizes visibility or blends in with legitimate activity. \n\nRather than directly disabling defenses, adversaries may use exploitation to circumvent monitoring and logging mechanisms. This can include abusing vulnerabilities in logging pipelines, security tools, or cloud infrastructure to evade audit trails, suppress alerts, or operate without generating telemetry. \n\nAdversaries may identify these opportunities through prior reconnaissance or by performing discovery of security controls after initial access. In some cases, vulnerabilities in SaaS or public cloud environments may be exploited to evade logging, obscure activity, or deploy infrastructure that remains hidden from standard monitoring tools.(Citation: Bypassing CloudTrail in AWS Service Catalog)(Citation: GhostToken GCP flaw)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1211","external_id":"T1211"},{"source_name":"Bypassing CloudTrail in AWS Service Catalog","description":"Nick Frichette. (2023, March 20). Bypassing CloudTrail in AWS Service Catalog, and Other Logging Research. Retrieved September 18, 2023.","url":"https://securitylabs.datadoghq.com/articles/bypass-cloudtrail-aws-service-catalog-and-other/"},{"source_name":"GhostToken GCP flaw","description":"Sergiu Gatlan. (2023, April 21). GhostToken GCP flaw let attackers backdoor Google accounts. Retrieved September 18, 2023.","url":"https://www.bleepingcomputer.com/news/security/ghosttoken-gcp-flaw-let-attackers-backdoor-google-accounts/"}],"platforms":["Linux","Windows","macOS","SaaS","IaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1211","id":"T1211","name":"Exploitation for Stealth","domain":"enterprise","platforms":["Linux","Windows","macOS","SaaS","IaaS"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas"],"source_url":"https://attack.mitre.org/techniques/T1211","technique_page":"techniques/enterprise/T1211/","page":"detections/enterprise/T1211/","status":"rule_source_available","counts":{"sigma":4,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"545a5da6-f103-4919-a519-e9aec1026ee4","title":"Microsoft Malware Protection Engine Crash","status":"test","level":"high","logsource":{"product":"windows","service":"application"},"data_path":"data/detection-rules/545a5da6-f103-4919-a519-e9aec1026ee4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/application_error/win_application_error_msmpeng_crash.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"48d91a3a-2363-43ba-a456-ca71ac3da5c2","title":"Audit CVE Event","status":"test","level":"critical","logsource":{"product":"windows","service":"application"},"data_path":"data/detection-rules/48d91a3a-2363-43ba-a456-ca71ac3da5c2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/microsoft-windows_audit_cve/win_audit_cve.yml","author":"Florian Roth (Nextron Systems), Zach Mathis","kind":"sigma"},{"id":"6c82cf5c-090d-4d57-9188-533577631108","title":"Microsoft Malware Protection Engine Crash - WER","status":"test","level":"high","logsource":{"product":"windows","service":"application"},"data_path":"data/detection-rules/6c82cf5c-090d-4d57-9188-533577631108.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/application/windows_error_reporting/win_application_msmpeng_crash_wer.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"ae9b0bd7-8888-4606-b444-0ed7410cb728","title":"Writing Of Malicious Files To The Fonts Folder","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/ae9b0bd7-8888-4606-b444-0ed7410cb728.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_hiding_malware_in_fonts_folder.yml","author":"Sreeman","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0595","name":"Detection Strategy for Exploitation for Stealth","url":"https://attack.mitre.org/detectionstrategies/DET0595","stix_id":"x-mitre-detection-strategy--da1e3af8-d79b-44ff-a907-ae107c110671","relationship_id":"relationship--ef12e912-df4b-4359-b38a-24071b74414a","description":"","analytics":[{"id":"AN1633","name":"Analytic 1633","guidance":"Detects exploitation attempts targeting defensive security software or OS services. Defender observation includes abnormal process behavior (e.g., AV or EDR crashing unexpectedly), unsigned/untrusted modules loaded into defensive processes, or privilege escalation from security agent services. Multi-event correlation ties exploitation attempts to subsequent evasive behavior like service termination or missing logs.","url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1633","platforms":["Windows"],"tuning":[{"field":"DefensiveProcessList","description":"List of defensive services/processes (e.g., AV, EDR) monitored in the environment."},{"field":"AllowedModulePaths","description":"Whitelisted DLL/module paths normally loaded by defensive tools."},{"field":"CrashThreshold","description":"Number of abnormal terminations of defensive processes tolerated before triggering an alert."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1633","source_url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1633","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0016","component":"Module Load","name":"WinEventLog:Sysmon","channel":"EventCode=7","platforms":["Windows"],"analytic_id":"AN1633","source_url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1633","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN1634","name":"Analytic 1634","guidance":"Detects kernel- or user-space exploitation attempts targeting auditd, AV daemons, or security monitoring agents. Defender observation includes unexpected segfaults, privilege escalation attempts from low-privileged processes, or modifications to security binaries. Correlates exploitation attempts with subsequent gaps in logging or terminated processes.","url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1634","platforms":["Linux"],"tuning":[{"field":"WatchedBinaries","description":"List of critical security daemons (e.g., auditd, falco, AV agents) to monitor for exploitation."},{"field":"CrashPatterns","description":"Regex or patterns for kernel/syslog errors correlated with exploitation attempts."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve: Execution of suspicious exploit binaries targeting security daemons","platforms":["Linux"],"analytic_id":"AN1634","source_url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1634","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0038","component":"Application Log Content","name":"linux:syslog","channel":"Segfaults, kernel oops, or crashes in security software processes","platforms":["Linux"],"analytic_id":"AN1634","source_url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1634","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN1635","name":"Analytic 1635","guidance":"Detects exploitation of macOS security and integrity services, such as Gatekeeper, XProtect, or EDR agents. Defender observations include unsigned processes attempting privileged operations, abnormal termination of security daemons, or modification of system integrity logs.","url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1635","platforms":["macOS"],"tuning":[{"field":"SecurityDaemons","description":"Monitored Apple and third-party EDR/AV daemon names."},{"field":"UnsignedProcessThreshold","description":"Number of unsigned high-privilege executions before alerting."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"macos:unifiedlog","channel":"Abnormal terminations of com.apple.security.* or 3rd-party security daemons","platforms":["macOS"],"analytic_id":"AN1635","source_url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1635","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0032","component":"Process Creation","name":"macos:osquery","channel":"execve: Unsigned or unnotarized processes launched with high privileges","platforms":["macOS"],"analytic_id":"AN1635","source_url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1635","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN1636","name":"Analytic 1636","guidance":"Detects exploitation of IaaS cloud security boundaries to evade defense controls. Defender perspective includes anomalous API calls that bypass audit logging, disable monitoring, or manipulate guardrails (e.g., CloudTrail tampering). Correlation highlights when exploitation attempts precede sudden absence of expected telemetry.","url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1636","platforms":["IaaS"],"tuning":[{"field":"CriticalAPIs","description":"List of sensitive cloud API operations that should be rare and tightly monitored."},{"field":"TimeWindow","description":"Duration for correlation of API exploitation with sudden logging gaps."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"AWS:CloudTrail","channel":"StopLogging, DeleteTrail, UpdateTrail: API calls that disable or modify logging services","platforms":["IaaS"],"analytic_id":"AN1636","source_url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1636","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN1637","name":"Analytic 1637","guidance":"Detects adversary abuse of SaaS platform vulnerabilities to bypass logging, monitoring, or consent boundaries. Defender perspective focuses on abnormal application integration events, missing audit logs, or API calls from unauthorized service principals that align with exploitation attempts.","url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1637","platforms":["SaaS"],"tuning":[{"field":"MonitoredApps","description":"Applications and integrations expected in the environment; deviations may be suspect."},{"field":"ConsentAnomalyThreshold","description":"Threshold for anomalous OAuth or app consent events before flagging exploitation."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"ApplicationModified, ConsentGranted: Unexpected app consent or modification events linked to security evasion","platforms":["SaaS"],"analytic_id":"AN1637","source_url":"https://attack.mitre.org/detectionstrategies/DET0595#AN1637","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has used CVE-2015-4902 to bypass security features.(Citation: Bitdefender APT28 Dec 2015)(Citation: Microsoft SIR Vol 19)","relationship_id":"relationship--e5706e1a-33a9-4404-9ef8-c8aa428363ec","references":[{"source_name":"Bitdefender APT28 Dec 2015","description":"Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"},{"source_name":"Microsoft SIR Vol 19","description":"Anthe, C. et al. (2015, October 19). Microsoft Security Intelligence Report Volume 19. Retrieved December 23, 2015.","url":"http://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf"}]},{"id":"G1047","name":"Velvet Ant","url":"https://attack.mitre.org/groups/G1047","kind":"intrusion-set","description":"[Velvet Ant](https://attack.mitre.org/groups/G1047) exploited CVE-2024-20399 in Cisco Switches to which the threat actor was already able to authenticate in order to escape the NX-OS command line interface and gain access to the underlying operating system for arbitrary command execution.(Citation: Sygnia VelvetAnt 2024B)","relationship_id":"relationship--c875bba4-cfc1-439d-919f-ed0997b9288b","references":[{"source_name":"Sygnia VelvetAnt 2024B","description":"Sygnia Team. (2024, July 1). China-Nexus Threat Group ‘Velvet Ant’ Exploits Cisco Zero-Day (CVE-2024-20399) to Compromise Nexus Switch Devices – Advisory for Mitigation and Response. Retrieved March 14, 2025.","url":"https://www.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group-velvet-ant-exploits-cisco-0-day/"}]}],"mitigations":[{"id":"M1019","name":"Threat Intelligence Program","url":"https://attack.mitre.org/mitigations/M1019","kind":"course-of-action","description":"Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.","relationship_id":"relationship--c97a4bfd-e279-476d-a96b-c00335510a2c","references":[]},{"id":"M1048","name":"Application Isolation and Sandboxing","url":"https://attack.mitre.org/mitigations/M1048","kind":"course-of-action","description":"Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing. Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation. Risks of additional exploits and weaknesses in these systems may still exist. (Citation: Ars Technica Pwn2Own 2017 VM Escape)","relationship_id":"relationship--eb812961-ecb7-4361-82c4-fb52fa93c80b","references":[{"source_name":"Ars Technica Pwn2Own 2017 VM Escape","description":"Goodin, D. (2017, March 17). Virtual machine escape fetches $105,000 at Pwn2Own hacking contest - updated. Retrieved March 12, 2018.","url":"https://arstechnica.com/information-technology/2017/03/hack-that-escapes-vm-by-exploiting-edge-browser-fetches-105000-at-pwn2own/"}]},{"id":"M1050","name":"Exploit Protection","url":"https://attack.mitre.org/mitigations/M1050","kind":"course-of-action","description":"Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. (Citation: TechNet Moving Beyond EMET) Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring. (Citation: Wikipedia Control Flow Integrity) Many of these protections depend on the architecture and target application binary for compatibility and may not work for software targeted for defense evasion.","relationship_id":"relationship--355eb66e-dc0a-44d4-b31d-3dbe7570a0d2","references":[{"source_name":"TechNet Moving Beyond EMET","description":"Nunez, N. (2017, August 9). Moving Beyond EMET II – Windows Defender Exploit Guard. Retrieved March 12, 2018.","url":"https://blogs.technet.microsoft.com/srd/2017/08/09/moving-beyond-emet-ii-windows-defender-exploit-guard/"},{"source_name":"Wikipedia Control Flow Integrity","description":"Wikipedia. (2018, January 11). Control-flow integrity. Retrieved March 12, 2018.","url":"https://en.wikipedia.org/wiki/Control-flow_integrity"}]},{"id":"M1051","name":"Update Software","url":"https://attack.mitre.org/mitigations/M1051","kind":"course-of-action","description":"Update software regularly by employing patch management for internal enterprise endpoints and servers.","relationship_id":"relationship--5ef60d6b-ffc0-4630-98d7-a67b608d5707","references":[]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1211":"/ttp-simulation/techniques/enterprise/T1211/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1211","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}