Detection Evasion
The message is built to keep some of its content from being read by automated security checks. What those checks see can differ from what the person reading the message sees.
Also known as
- Broader terms
-
- Obfuscated Files or Information
- defense evasion
Sub-techniques
TE0010.1
Text and Markup Obfuscation
The message's text is altered behind the scenes, for example with split words, look-alike characters, or invisible text. Attackers do this so filters may not read the words a person sees.
TE0010.2
Text Padding
The message includes unrelated, harmless-looking text, sometimes hidden, around its actual request. Filler like this is used to make a message look ordinary to automated filters.
TE0010.3
Image-Based Email Content
The message's main content or request is an image instead of selectable text. Words inside an image are harder for automated filters to read.
TE0010.6
Destination URL Encoding
A link's web address is written in a coded form, so the real address appears only once it's converted back. This is aimed at automated scanners that check where links lead.
TE0010.8
Password-Protected Payload File
A file in this message, or linked from it, needs a password to open. Attackers lock files this way so automated security tools can't inspect what's inside.
TE0010.9
HTML Smuggling
A web page or attached file contains code that assembles a downloadable file inside the browser. Attackers do this so the file never passes through email or web filters as a normal download.
TE0010.10
Link Padding
The message contains several links to real, unrelated websites that play no part in its request. Extra links like these can make a message look ordinary to automated filters.
TE0010.11
Nested Attachment Packaging
The delivered content sits inside two or more layers of attached containers, such as an archive within an archive or a message within a message. Layers like these make automated inspection harder.
TE0010.12
File Size Inflation
A file in this message is padded with filler that makes it much larger than its content needs. Some security tools skip files above a certain size, which makes oversized files harder to inspect.