Defense Evasion

• T1562: Impair Defenses

• T1140: Deobfuscate/Decode Files or Information

• T1027: Obfuscated Files or Information

• T1497: Virtualization/Sandbox Evasion

• T1070: Indicator Removal on Host

• T1036: Masquerading

• T1218: Signed Binary Proxy Execution

• T1574: Hijack Execution Flow

• T1553: Subvert Trust Controls

• T1480: Execution Guardrails

• T1499: Endpoint Denial of Service