Endpoint security evasion is a set of actions attackers use to make hostile activity less visible to endpoint protection tools such as antivirus, EDR, and application controls. The goal is not always to stop defenses completely, but to delay detection long enough to steal data, move laterally, or deploy ransomware.
Common evasion methods include process injection, disabling security services, obfuscating payloads, using legitimate system tools for malicious tasks, and running code only in memory. These techniques matter because endpoint tools are often the first line of defense on a host, and gaps in visibility can let an intrusion progress quickly. Defenders counter evasion with hardened configurations, tamper protection, behavioral detection, script and macro controls, allowlisting, and rapid alert triage across endpoints, identities, and network activity.