Kernel-level evasion is stealth behavior designed to avoid detection by operating at, or manipulating, the operating system kernel and other low-level components. Because security tools often rely on kernel data to see processes, files, network activity, and code injection, evasion at this layer can hide malicious activity from normal monitoring.
In cyber security, this matters because it can reduce visibility for endpoint detection and response, antivirus, and forensic tools. Attackers may use kernel drivers, rootkit techniques, direct system call manipulation, or tampering with security components to obscure persistence, credential theft, or ransomware activity. Defenders counter it with signed driver controls, kernel tamper protection, memory and behavior-based detection, privileged access monitoring, and offline analysis when the live system cannot be trusted.