Detection and evasion are the same problem viewed from opposite ends. Every improvement in how security products identify malicious code becomes, almost immediately, a specification for how the next sample will avoid being identified. That is not a failure of the industry. It is the structure of an adversarial contest, and understanding the techniques on the other side is what stops a defender from mistaking a quiet console for a secure network.
Malware is difficult to detect because detection has to generalise and evasion does not. A detection engine must recognise threats it has never seen, at scale, without flooding an analyst with false positives. An evasion technique only has to be unfamiliar once, for long enough to execute. That asymmetry is the whole game.
Evading signature-based detection
The oldest form of detection matches known-bad patterns: file hashes, byte sequences, distinctive strings. It is fast, cheap and precise, and it fails against anything that has not been catalogued yet. Signature-based detection remains valuable as a first filter, but it is trivially defeated by changing the bytes without changing the behaviour.
Polymorphism does this by encrypting the payload and varying the small decryption routine on every build. The functional code is identical each time; its on-disk representation never is, so a hash-based signature matches nothing.
Metamorphism goes further and rewrites the malicious code itself between generations — substituting equivalent instructions, reordering independent operations, inserting junk that has no effect. There is no static decryptor to catch, because there is no constant region at all.
Packing and crypters wrap a payload in a compression or encryption layer that unpacks in memory at runtime. Packers are entirely legitimate technology — commercial software uses them for size and intellectual property reasons — which is precisely why their presence alone cannot be treated as malicious.
The practical consequence is that a clean scan proves less than it appears to. It establishes that nothing matched a known pattern, which is a different statement from "nothing malicious is present". This is a large part of how malware has evolved: not towards greater destructiveness, but towards greater ordinariness.
Evading sandboxes and dynamic analysis
Because static inspection is so readily defeated, defenders detonate suspicious files in instrumented environments and watch what they do. Dynamic analysis is far harder to fool than a signature — so malware authors stopped trying to fool the analysis and started trying to detect it instead.
The logic is simple: if the sample can work out that it is being observed, it does nothing interesting, is classified as benign, and proceeds unimpeded on the next machine.
Environment checks look for the fingerprints of virtualisation and analysis — hypervisor artefacts, virtual network adapters, implausibly small disks, two CPU cores, no printer, a hostname like SANDBOX-01, a user profile with no browser history and a desktop created eleven minutes ago.
Timing and stalling exploits the fact that automated analysis has a budget. A sandbox typically observes a sample for a few minutes; a payload that sleeps for an hour, or performs several million pointless calculations first, outlasts the observation window. More sophisticated variants measure whether sleep calls were artificially accelerated, which is a common sandbox countermeasure, and treat the discrepancy as proof of instrumentation.
Human-interaction gates require something an automated environment rarely produces — meaningful mouse movement, a document scrolled to the second page, a dialogue dismissed by hand. No interaction, no execution.
None of this is exotic any longer. It is standard commodity tooling, which is why sandbox verdicts should inform decisions rather than settle them.
Living off the land
The most effective evasion available today is to introduce no malicious file at all.
Living-off-the-land techniques accomplish objectives using software already present and already trusted — scripting engines, management frameworks, signed system binaries with useful side effects such as downloading a file or executing code on another process's behalf. Fileless variants stay resident in memory and never write a payload to disk for a scanner to find.
This defeats file-centric defence completely, because there is no file. It also defeats naive behavioural rules, because the observed activity — an administrative tool contacting a server, a scripting host running a script — is indistinguishable in isolation from legitimate administration. What separates the two is context: which account, on which host, at what hour, in what sequence, and whether that combination has ever occurred before.
That is the argument for indicators of attack over indicators of compromise. An IOC describes something known to be bad and is obsolete the moment the attacker changes it. An IOA describes a sequence that is suspicious regardless of the specific tooling used to produce it, and it survives the tooling changing.
Evasion on the network
Command-and-control traffic faces the same pressure and has adapted the same way — by becoming unremarkable.
Nearly all of it is encrypted now, which removes payload inspection as an option for most organisations. Beacon intervals are randomised so the callback does not appear as a machine-regular pulse. Traffic is routed through reputable cloud, collaboration and content-delivery platforms that no enterprise can plausibly block wholesale. DNS is used as a covert channel, increasingly over encrypted transports that bypass the internal resolver where logging happens.
The defensive consequence is that intrusion detection now depends far more on metadata and behaviour — who is talking to whom, how often, in what volume, at what times — than on the content of the conversation. Detecting anomalies in shape rather than substance is the workable approach, which requires knowing what normal looks like for your environment.
What actually works against evasion
No single control defeats a determined and well-resourced adversary. The realistic objective is to make evasion expensive, noisy, and limited in payoff when it succeeds.
Detect behaviour, not artefacts. Techniques change constantly; objectives change slowly. Credential access, privilege escalation, persistence, discovery and lateral movement have to happen for most intrusions to matter, and each leaves traces that are far harder to disguise than a file hash.
Assume something will get through, and constrain what happens next. Network segmentation, least privilege and egress filtering do not prevent execution. They determine whether execution on one endpoint becomes an incident or a footnote — and evasion buys an attacker very little if the compromised host can reach almost nothing.
Reduce what is reachable. Every unnecessary exposed service is an entry point that never needed defending. A smaller attack surface is fewer opportunities to evade anything at all.
Instrument for the absence of signal. Because successful evasion produces silence, treat silence as information. An endpoint agent that stopped reporting, a log source that went quiet, a scheduled job that no longer runs — these are among the most reliable indicators available, precisely because an attacker suppressing telemetry cannot also fake its continued presence.
The part you do not control
All of the above assumes the environment is yours to instrument. Increasingly, the relevant environment is not.
A supplier with weak detection is an unmonitored path into your data, and you cannot deploy your controls onto their estate or audit their alerting. What you can do is assess what is externally observable about them — exposed services, ageing infrastructure, expired certificates, evidence of prior compromise — and treat a deteriorating external posture as the signal it is. An organisation that leaves obvious exposures unattended is not one detecting sophisticated evasion internally.
RiskXchange assesses organisations and their suppliers from the outside in, continuously, using the same public signals an attacker would begin from. If you would like to see what that surfaces about your supply chain, get in touch.