T1211Stealth
Exploitation for Stealth
Adversaries may exploit vulnerabilities to evade detection by hiding activity, suppressing logging, or operating within trusted or unmonitored components. Adversaries may exploit a system or application vulnerability to avoid detection while maintaining access within an environment. Exploitation occurs when an adversary leverages a programming flaw to execute code in a manner that minimizes…
CVEs41
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.36
Reports1
Detections
4 Sigma rules tagged T1211Exploitation for StealthT12114 general rules
- Audit CVE Eventcriticaltest
- Microsoft Malware Protection Engine Crashhightest
- Microsoft Malware Protection Engine Crash - WERhightest
- Writing Of Malicious Files To The Fonts Foldermediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Exploitation for Stealth
41 CVEs, by priority. Each link shows its badge.- CVE-2012-0507Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityOracle · Java SEKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1211Exploitation for Stealth+1 more · 2 reportsAI mapping from the description · primary impact98.2%Top 0.09%86.0priority
- CVE-2023-36025Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityAI mapping from the description · primary impact88.1%Top 0.23%79.1priority
- CVE-2022-21999Microsoft Windows Print Spooler Privilege Escalation VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.8T1078Valid AccountsT1059Command and Scripting Interpreter+3 moreMITRE CTID mapping of the KEV entry · follow-on activity41.0%Top 1.3%78.2priority
- CVE-2025-26633Microsoft Windows Management Console (MMC) Improper Neutralization VulnerabilityMicrosoft · WindowsKEVRansomwarePublic exploitHigh · 7.0T1059Command and Scripting InterpreterT1211Exploitation for StealthAI mapping from the description · how it is exploited30.4%Top 1.8%77.5priority
- CVE-2010-0738Red Hat JBoss Authentication Bypass VulnerabilityRed Hat · JBossKEVRansomwarePublic exploitMedium · 5.3T1190Exploit Public-Facing ApplicationT1211Exploitation for StealthAI mapping from the description · primary impact73.8%Top 0.52%76.6priority
- CVE-2022-44698Microsoft Defender SmartScreen Security Feature Bypass VulnerabilityMicrosoft · DefenderKEVRansomwareMedium · 5.4T1204.002Malicious FileT1211Exploitation for Stealth1 reportAI mapping from the description · primary impact76.3%Top 0.46%75.6priority
- CVE-2026-21510Microsoft Windows Shell Protection Mechanism Failure VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 8.8T1211Exploitation for StealthT1553Subvert Trust ControlsAI mapping from the description · how it is exploited61.2%Top 0.84%74.0priority
- CVE-2026-21509Microsoft Office Security Feature Bypass VulnerabilityAI mapping from the description · primary impact70.8%Top 0.6%73.3priority
- CVE-2022-4135Google Chromium GPU Heap Buffer Overflow VulnerabilityGoogle · Chromium GPUKEVPublic exploitCritical · 9.6T1189Drive-by CompromiseT1211Exploitation for StealthAI mapping from the description · primary impact31.9%Top 1.7%69.4priority
- CVE-2026-21514Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision VulnerabilityAI mapping from the description · primary impact1.6%Top 24%68.6priority
- CVE-2015-0016Microsoft Windows TS WebProxy Directory Traversal VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1211Exploitation for StealthAI mapping from the description · how it is exploited75.8%Top 0.48%68.4priority
- CVE-2019-16256SIMalliance Toolbox Browser Command Injection VulnerabilitySIMalliance · Toolbox BrowserKEVPublic exploitCritical · 9.8T1059Command and Scripting InterpreterT1211Exploitation for Stealth+1 moreAI mapping from the description · how it is exploited4.9%Top 7.8%68.3priority
- CVE-2020-1464Microsoft Windows Spoofing VulnerabilityMicrosoft · WindowsKEVPublic exploitHigh · 7.8T1211Exploitation for StealthT1553Subvert Trust ControlsAI mapping from the description · how it is exploited38.9%Top 1.4%68.2priority
- CVE-2021-42292Microsoft Excel Security Feature BypassAI mapping from the description · primary impact43.0%Top 1.3%68.2priority
- CVE-2020-3837Apple Multiple Products Memory Corruption VulnerabilityApple · Multiple ProductsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1211Exploitation for StealthAI mapping from the description · how it is exploited14.8%Top 3.3%67.8priority
- CVE-2013-2460Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier…AI mapping from the description · primary impact70.0%Top 0.62%67.4priority
- CVE-2013-2423Oracle JRE Unspecified VulnerabilityOracle · Java Runtime Environment (JRE)KEVPublic exploitEnd of lifeLow · 3.7T1211Exploitation for Stealth1 reportAI mapping from the description · primary impact85.2%Top 0.29%64.4priority
- CVE-2021-30633Google Chromium Indexed DB API Use-After-Free VulnerabilityGoogle · Chromium Indexed DB APIKEVCritical · 9.6T1189Drive-by CompromiseT1211Exploitation for StealthAI mapping from the description · primary impact33.2%Top 1.6%64.4priority
- CVE-2026-58704Google Pixel Improper Authorization VulnerabilityAI mapping from the description · how it is exploited0.6%Top 50%64.1priority
- CVE-2021-37973Google Chromium Portals Use-After-Free VulnerabilityAI mapping from the description · primary impact11.7%Top 3.9%63.9priority
- CVE-2023-35311Microsoft Outlook Security Feature Bypass VulnerabilityAI mapping from the description · primary impact15.5%Top 3.2%63.5priority
- CVE-2023-32409Apple Multiple Products WebKit Sandbox Escape VulnerabilityAI mapping from the description · primary impact16.5%Top 3%63.4priority
- CVE-2020-1040Microsoft Hyper-V RemoteFX vGPU Remote Code Execution VulnerabilityMicrosoft · Hyper-V RemoteFXKEVCritical · 9.0T1059Command and Scripting InterpreterT1211Exploitation for StealthAI mapping from the description · how it is exploited7.4%Top 5.6%63.2priority
- CVE-2024-23296Apple Multiple Products Memory Corruption VulnerabilityApple · Multiple ProductsKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1211Exploitation for StealthAI mapping from the description · primary impact1.4%Top 27%63.0priority
- CVE-2021-30883Apple Multiple Products Memory Corruption VulnerabilityApple · Multiple ProductsKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1211Exploitation for StealthAI mapping from the description · how it is exploited14.7%Top 3.3%62.8priority
- CVE-2024-30040Microsoft Windows MSHTML Platform Security Feature Bypass VulnerabilityAI mapping from the description · primary impact3.9%Top 9.6%62.2priority
- CVE-2021-31010Apple iOS, macOS, watchOS Sandbox Bypass VulnerabilityApple · iOS, macOS, watchOSKEVHigh · 7.5T1068Exploitation for Privilege EscalationT1211Exploitation for StealthAI mapping from the description · how it is exploited3.7%Top 10%61.2priority
- CVE-2021-30983Apple iOS and iPadOS Buffer Overflow VulnerabilityApple · iOS and iPadOSKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1211Exploitation for StealthAI mapping from the description · how it is exploited2.9%Top 13%60.9priority
- CVE-2025-24200Apple iOS and iPadOS Incorrect Authorization VulnerabilityAI mapping from the description · how it is exploited4.5%Top 8.6%60.6priority
- CVE-2013-0431Oracle JRE Sandbox Bypass VulnerabilityOracle · Java Runtime Environment (JRE)KEVRansomwarePublic exploitEnd of lifeLow · 3.7T1211Exploitation for StealthAI mapping from the description · primary impact90.1%Top 0.2%60.5priority
- CVE-2023-38606Apple Multiple Products Kernel Unspecified VulnerabilityApple · Multiple ProductsKEVMedium · 5.5T1068Exploitation for Privilege EscalationT1211Exploitation for StealthAI mapping from the description · primary impact2.9%Top 13%59.2priority
- CVE-2024-23225Apple Multiple Products Memory Corruption VulnerabilityApple · Multiple ProductsKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1211Exploitation for StealthAI mapping from the description · primary impact1.5%Top 26%58.2priority
- CVE-2022-48618Apple Multiple Products Memory Corruption VulnerabilityApple · Multiple ProductsKEVHigh · 7.0T1068Exploitation for Privilege EscalationT1211Exploitation for StealthAI mapping from the description · primary impact0.5%Top 58%51.3priority
- CVE-2022-22265Samsung Mobile Devices Use-After-Free VulnerabilitySamsung · Mobile DevicesKEVHigh · 7.8T1068Exploitation for Privilege EscalationT1211Exploitation for StealthAI mapping from the description · primary impact0.4%Top 67%50.1priority
- CVE-2021-25395Samsung Mobile Devices Race Condition VulnerabilitySamsung · Mobile DevicesKEVMedium · 6.4T1068Exploitation for Privilege EscalationT1211Exploitation for StealthAI mapping from the description · primary impact0.4%Top 70%48.6priority
- CVE-2015-0071Microsoft Internet Explorer ASLR Bypass VulnerabilityMicrosoft · Internet ExplorerKEVEnd of lifeMedium · 6.5T1189Drive-by CompromiseT1211Exploitation for StealthAI mapping from the description · primary impact33.6%Top 1.6%47.2priority
- CVE-2023-21237Android Pixel Information Disclosure VulnerabilityAI mapping from the description · how it is exploited0.3%Top 81%45.6priority
- CVE-2020-11019Out of bound read in update_recv in FreeRDPFreeRDP · FreeRDPPublic exploitMedium · 4.3T1211Exploitation for StealthT1005Data from Local System+1 moreMITRE CTID mapping of the CVE · follow-on activity2.3%Top 17%24.6priority
- CVE-2020-1141Windows GDI Information Disclosure VulnerabilityMicrosoft · Windows 10 Version 1507Medium · 5.5T1211Exploitation for StealthT1005Data from Local SystemMITRE CTID mapping of the CVE · follow-on activity2.0%Top 19%20.0priority
- CVE-2020-11087Out-of-bounds Read in FreeRDPMITRE CTID mapping of the CVE · follow-on activity1.4%Top 27%16.7priority
- CVE-2020-3244Cisco ASR 5000 Series Aggregation Services Routers Enhanced Charging Service Rule Bypass VulnerabilityCisco · Cisco ASR 5000 Series SoftwareMedium · 5.3T1190Exploit Public-Facing ApplicationT1211Exploitation for StealthMITRE CTID mapping of the CVE · primary impact1.0%Top 37%16.3priority