How Attackers Avoid Detection Post-Intrusion

The following are common ways attackers conceal themselves on systems they're already compromised:

• Using rootkits
• Hiding data
• Tampering with log files

Here are some common ways to hide data:

• Use the hidden file attribute
• Hide data in NTFS alternate file streams
• Replace or rename files
• Use steganography

Adopted from the book Assessing Network Security by Ben Smith, David LeBlanc, Kevin Lam.