🎯 Defense evasion

The items that name it 4

• Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
  writeup2026-10-28It is written here as Defense evasion: timestomping and deletion of writable-overlay PAM configurations for sshd and login.
• From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM Usage
  writeup2026-10-20It is written here as Defense evasion: using IP addresses geolocated in the victim organization's headquarters country.
• Incident response guide for AWS CloudTrail investigations – Part 1 | Amazon Web Services
  writeup2026-09-03

  Techniques to avoid detection, such as operating in a Region with less monitoring or naming unauthorized resources to look legitimate; session naming masquerade (e.g. "dev-migration-script") to blend into operational noise

• How the RaaS Business Model Actually Works
  article2026-07-01

  Attackers work to evade defenses after gaining access and before encryption