---
{
  "title": "Evasion and evidence of activity",
  "summary": "Understand concealment from a defender’s perspective while preserving test evidence.",
  "topic": "offensive",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    10
  ],
  "aliases": [],
  "sources": [
    {
      "title": "MITRE ATT&CK: Get started",
      "url": "https://attack.mitre.org/resources/"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

Adversaries may attempt to reduce visibility, manipulate records, or disguise activity as normal administration. Defenders should monitor relevant configuration changes, unexpected logging gaps, and other signs of reduced coverage. Authorized assessment work preserves its own evidence and follows agreed procedures rather than deleting records to conceal activity. A collection gap can also have legitimate causes, so validate explanations before inferring intent.

## In practice

A defender notices logging stopped after a privileged change and checks configuration history, system health, and change approvals.

## A common misunderstanding

Missing logs do not automatically prove deliberate deletion, and a training phase label does not authorize evidence destruction.

## Check your understanding

What should an investigation of a logging gap examine?

**Think it through:** Source health, retention, configuration, access records, collection failures, and related administrative actions.


## Reduced visibility is itself worth investigating

Evasion attempts make unauthorized behavior harder to notice or interpret. They can involve disguising execution, changing protective settings, or interfering with records. The mechanism matters because a missing log, an unusual process name, and an altered security policy require different evidence and responses. A broad evasion label should not replace that explanation.

Visibility also fails for ordinary reasons. Agent outages, expired credentials, storage limits, upgrades, and network interruptions can create gaps. Investigators should compare health telemetry, change approvals, configuration history, and the surrounding activity. A gap is a lead, not proof that an intruder deliberately erased evidence.

## A fictional silent endpoint

An academy's monitoring stops receiving events from one workstation shortly after an unusual administrator session. The team checks collection health, service state, central configuration records, and identity activity. It preserves evidence from independent sources while determining whether the gap reflects a technical fault, approved work, or unauthorized interference.

If monitoring is restored, retain the gap's time boundary and explain what cannot be reconstructed. Do not fill the interval with assumptions based only on later behavior. Independent identity, application, and network records can partially compensate, but each has its own coverage and retention limits.

## Practice an evidence-preserving assessment

Create fictional records showing a sensor outage and a configuration change. Write two benign explanations and one suspicious explanation, then identify the evidence that would distinguish them. For authorized testing, specify how the assessment team records its own actions and protects the audit trail.

The objective is to help defenders recognize and validate reduced coverage, not teach deletion of records or concealment from a real security team. A good test produces reviewable evidence and a clear remediation question, such as whether an unexpected configuration change is noticed and escalated through the agreed process.

## Keep exploring

- [[logs-and-telemetry]]
- [[persistence]]
- [[chain-of-custody]]
- [[mitre-attack]]