TechKnowSurge
TechKnowSurge Catalog Videos Stealth Techniques
VideoSecurityFree

Stealth Techniques

Stealth techniques allow attackers to operate on a compromised network without being detected, covering both the actions they take and the traffic they generate. Understanding these methods is essential for recognizing how adversaries evade intrusion detection systems and other security controls.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

When an attacker gains access to a network, two broad categories of exposure create risk of detection: the actions performed on the system and the traffic flowing between the attacker and the compromised environment. Both must be managed carefully to avoid triggering security controls. Common activities such as creating user accounts, installing malware, scanning the network, and exfiltrating files all leave observable traces that defenders and their tools can identify. Traffic-based detection is a particular concern because command-and-control communication and data exfiltration produce patterns that intrusion detection systems are specifically designed to flag. To counter this, attackers use a range of techniques to make malicious traffic appear benign or difficult to analyze. These include mimicking legitimate traffic patterns, reducing the volume and frequency of communications, obfuscating or encoding data in transit, encrypting payloads to prevent deep packet inspection, fragmenting traffic into smaller units, and randomizing timing or structure to avoid signature-based detection. Together, these methods form the foundation of operational stealth in adversarial engagements.

What you'll learn

What's covered

Stealth Techniques

Key terms

Intrusion Detection System
IDS
A system that monitors network or system activities for malicious behavior and generates alerts.
Data Exfiltration
The unauthorized transfer of data from a system to an external destination.
Encryption
The process of converting readable data into an unreadable format using an algorithm and key to prevent unauthorized access.
Obfuscation
The deliberate manipulation of data, code, or a URL to disguise its true purpose and evade detection by security tools or users. Malware authors use obfuscation to hide malicious behavior; attackers use it in phishing URLs to disguise destinations.
Traffic Fragmentation
A technique that breaks network traffic into smaller packets or segments to evade inspection by intrusion detection systems.
Command and Control
C2
Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.

Topics

Stealth Techniques Intrusion Detection Evasion Traffic Obfuscation Traffic Fragmentation Network Security Threat Actor Tactics

Transcript

Stealth techniques are what an adversary is going to be doing in order to cover their tracks and make sure they're not discovered on a network.

Two categories

If we're hacking a network, I see stealth techniques as falling into one of two categories. Number one is hiding what we're doing. If we're creating an account, or creating some sort of malware or installing some sort of malware, or we're doing things on the network, we're doing things that could be discoverable, that leave traces behind. An account leaves a whole account behind, so somehow we need to hide what it is that we're doing. The other thing is that as we go in and out, there's traffic that's going in and out as well, so somehow we need to hide that traffic.

Overt activities

If we hacked into a network, there are going to be several overt activities, that is, activities that can be seen. So if anybody's looking in, and there are certain types of defenses, they're going to see what's going on. For instance, if we do a scan of this network, if we're scanning things, then that is discoverable. Or there is the command and control: if we're controlling a machine inside the network, that means traffic is being tunneled back and forth between the adversary, us, and the computer, so that can be observed. Somebody could see it, it's overt. And then there's also data exfiltration. Let's say we find some files and we're copying them to our machine. That could be seen, because there is equipment out there and devices out there that can see that data exfiltration.

Avoiding detection

We want to avoid intrusion detection, and there is equipment like intrusion detection systems that do exactly that: if we were to break into this network, it would be able to see that traffic flowing back and forth. That's where we need to have some sort of stealth techniques, where somehow we need to emulate the traffic that you would normally see on the network.

Some ways that we could do that:

  • We could emulate legitimate traffic, so try to pretend that the traffic that's going back and forth is legitimate and somehow disguise it that way.
  • Or limit it, not have so much chatty back and forth, and maybe do it in stages.
  • Maybe we obfuscate it, so the traffic that's going back and forth is encoded, or has some sort of obfuscation to it that really makes it hard to discover.
  • Or we could encrypt it, so that no one could inspect and see what data is actually going in and out.
  • Or we could fragment it and break it into smaller little components.
  • Or we could randomize it, kind of mixing it up, which I guess is a type of obfuscation.

So there are a lot of different techniques that we could use to disguise what we're doing on a network.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →