Home/ MITRE Matrix/ Defense Evasion/ T1211

T1211Exploitation for Stealth

T1211 — Exploitation for Stealth is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 6 detection use cases covering it and 3 threat-intel articles citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

6Use cases

3Articles

0Sub-techniques

1Tactic

Use cases covering this technique (6)

[WEEKLY] AI-Agent Server (PraisonAI/MCP) Spawns OS Shell or Recon LOLBin — Unauthenticated RCE Exploitation Internal exploit · alerting DSΣPDDCS [WEEKLY] Language-runtime server (node/python/java) spawns OS shell shortly after inbound request — eval / sandbox-escape exploitation chain Internal exploit · alerting DSPDD [WEEKLY] Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress Internal exploit · alerting DSΣPDD [LLM] Exposure hunt: vCenter auth-bypass + directory-traversal RCE (CVE-2026-59309 / CVE-2026-59310) Bespoke exploit · hunting DSP [LLM] Cruciferra BYOVD: vulnerable driver (GoFlyDrv.sys) load for EDR tampering Bespoke install · alerting DSΣPDDCS [LLM] NodeBB ActivityPub inbox POST carrying HTML-breakout id (Federation Errors stored XSS) Bespoke exploit · hunting SΣP

Articles citing this technique (3)

crit Three Critical VMware Flaws Allow Auth Bypass, Code Execution, and VM Escape art-13

crit Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware art-65

high Finding eight high-severity vulnerabilities in NodeBB in six hours art-115