Detection evasion is the use of tactics that help malicious activity blend in with normal system behavior and avoid security alerts. Instead of relying on obviously malicious files or commands, attackers may abuse trusted software, common scripting environments, signed binaries, or normal-looking command lines so their actions resemble legitimate administration or developer activity.
It matters because many defenses depend on spotting unusual processes, suspicious parent-child relationships, rare network behavior, or known malware fingerprints. When attackers use a legitimate runtime or built-in tool, those signals can be weaker or disappear entirely. Defenders respond with behavior-based detection, process lineage analysis, command-line inspection, and allowlisting policies that limit which tools may run, where they can run from, and what permissions they receive. In practice, detection evasion is not a single exploit but a pattern of concealment that helps intrusion steps remain quiet long enough to execute, persist, or exfiltrate data.