--- title: "The Mechanics of Defense Evasion" url: https://daily.dev/posts/the-mechanics-of-defense-evasion-tcebdux41 source_url: https://www.huntress.com/blog/the-mechanics-of-defense-evasion type: article source: "Huntress Blog" published: 2026-05-31T07:42:27.515Z updated: 2026-05-31T08:16:40.981Z tags: ["malware", "powershell"] reading_time: 12 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Mechanics of Defense Evasion **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 12 min read · 0 upvotes · 0 comments ## Summary A practical walkthrough of seven real-world defense evasion techniques observed by Huntress, covering: disabling/excluding AV via PowerShell (T1562.001), killing EDR processes with Backstab, obfuscated PowerShell scripts and AsyncRAT delivery (T1027), executables hidden inside LNK shortcut files (T1036), AMSI/ETW bypass techniques, social engineering via fake QuickBooks popups (T1204), and reflective loading into trusted binaries like CasPol.exe (T1620). Each case includes MITRE ATT&CK references and brief detection notes, with emphasis on how attackers exploit both technical gaps and human behavior. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [MITRE ATT&CK is Deprecating a Tactic: 3 Takeaways from the “Defense Evasion” Break-up](https://daily.dev/posts/mitre-att-ck-is-deprecating-a-tactic-3-takeaways-from-the-defense-evasion-break-up-dhgrwpvwi) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#powershell](https://daily.dev/tags/powershell) [View this post on daily.dev](https://daily.dev/posts/the-mechanics-of-defense-evasion-tcebdux41)