Evasion Glossary

Browse 19 evasion terms defined in plain English, from the cultural dictionary of computing.

19 Evasion Terms

Anti-Debug Technique
A method used by malware or protected software to detect, disrupt, or mislead debuggers so analysis becomes harder. Common anti-debug techniques include timing...
Bypass
A method of circumventing a security control, policy, or expected validation path without directly disabling it. Bypasses matter because a control can appear...
Covert Channel
A hidden communication path that violates intended security policy by transferring information through indirect or unauthorized means, such as timing, resource...
Domain Fronting
Domain Fronting is a traffic-routing technique that hides the true destination behind a permitted front domain in shared infrastructure. Security teams use it...
Double Encoding
The practice of encoding input twice, often to bypass filters that decode or inspect data only once before passing it deeper into a system. Attackers use...
Dynamic DNS Abuse
The malicious use of dynamic DNS services to keep domain names pointed at changing IP addresses, often for phishing, malware command and control, or rapid...
Emulation Detection
Techniques used by malware to determine whether it is running in an emulator, sandbox, or analysis environment rather than on a normal victim system. If...
Encoded Payload
Encoded Payload is a payload transformed into another representation so it bypasses filters, transports safely, or evades inspection. Security teams use it to...
Fileless Malware
Fileless Malware is malicious activity that relies heavily on memory, scripts, and legitimate tools instead of obvious dropped binaries. Security teams use it...
Fragment Attack
An attack that abuses IP packet fragmentation to evade inspection, confuse reassembly behavior, or trigger bugs in network stacks and firewalls. Fragment...
Living off the Land
Living off the Land is the use of legitimate system tools and administration features to execute attacker objectives with minimal malware. Security teams use...
Low and Slow Attack
An attack carried out gradually and with low per-connection or per-event volume so it stays below obvious detection thresholds while still causing damage or...
Memory Injection
A technique in which attacker-controlled code is written into the memory of a running process and then executed there, often to evade detection or inherit...
Multi-Hop
Involving multiple sequential network relays, tunnels, or pivot points between origin and destination rather than a single direct path. In security, multi-hop...
Obfuscation
Obfuscation is the concealment of code, data, or behavior so analysis and detection become more difficult. Security teams use it to enforce trust, reduce...
Packet Spoofing
The crafting of network packets with falsified source or other header fields to disguise origin, bypass simple trust assumptions, or aid reflection and evasion...
Payload Encryption
The practice of encrypting a malicious payload so it is harder for defenders, scanners, or intermediate systems to inspect before execution. Attackers often...
Polymorphic Malware
Malware that changes parts of its code, encryption, or structure across generations while preserving its core behavior, making signature-based detection...
Proxy Detection
The identification of traffic coming through proxies, VPN exits, anonymizers, or relay infrastructure instead of directly from the originating user or system....

Related Topics