Home/ MITRE Matrix/ Defense Evasion/ T1211

T1211Exploitation for Stealth

T1211 — Exploitation for Stealth is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 10 detection use cases covering it and 4 threat-intel articles citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

10Use cases

4Articles

0Sub-techniques

1Tactic

Use cases covering this technique (10)

[WEEKLY] AI-Agent Server (PraisonAI/MCP) Spawns OS Shell or Recon LOLBin — Unauthenticated RCE Exploitation Internal exploit · alerting DSΣPDDCS [WEEKLY] Language-runtime server (node/python/java) spawns OS shell shortly after inbound request — eval / sandbox-escape exploitation chain Internal exploit · alerting DSPDD [WEEKLY] Low-Code / AI Workflow Runtime Sandbox-Escape — Server Process Spawns Shell + Public Egress Internal exploit · alerting DSΣPDD [LLM] Node.js runtime spawning shell/recon child process (vm2 CVE-2026-47686 escape RCE) Bespoke exploit · hunting DSΣPDDCS [LLM] Vulnerable vm2 package present on host (CVE-2026-47686, vm2 <= 3.11.5) Bespoke recon · hunting DSP [LLM] Traefik ReplacePathRegex auth bypass: glued dot-dot traversal in request path Bespoke exploit · alerting SΣPDD [LLM] Traefik path-traversal bypass CONFIRMED: traversal request returns 2xx on protected route Bespoke actions · alerting SPDD [LLM] Flowise/node process spawning Unix shell or netcat reverse shell (CVE-2026-69254 vm2 escape) Bespoke install · alerting DSΣPDDCS [LLM] Flowise API exploitation: path-traversal / JS-injection payloads to /api/v1 endpoints (CVE-2026-69254) Bespoke delivery · hunting SΣP [LLM] NodeBB ActivityPub inbox POST carrying HTML-breakout id (Federation Errors stored XSS) Bespoke exploit · hunting SΣP

Articles citing this technique (4)

crit [GHSA / CRITICAL] CVE-2026-47686: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE art-13

crit [GHSA / CRITICAL] CVE-2026-65600: Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware art-111

crit [GHSA / CRITICAL] CVE-2026-69254: Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override art-129

high Finding eight high-severity vulnerabilities in NodeBB in six hours art-222