NDR evasion techniques are behaviors that obscure network activity or reduce what network detection and response (NDR) tools can see. They are not one named MITRE ATT&CK technique: the umbrella includes behaviors such as protocol tunneling, encrypted channels, proxies, non-standard encoding, and interference with defensive tools or logs. Hiding payload content or the origin of a connection does not necessarily erase its metadata, network patterns, endpoint context, or signs that telemetry has gone missing.
How do NDR evasion techniques weaken visibility?
NDR depends on the traffic and related evidence available to its sensors. A technique can make that evidence harder to interpret without making all activity invisible. Encryption can conceal message contents; tunneling can make one protocol look like part of another; proxies can put intermediaries between a system and its destination; and impaired logging can remove evidence that would otherwise help an investigation.
As an Amazon Associate I earn from qualifying purchases.
MITRE ATT&CK describes protocol tunneling this way: “Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems.” That is MITRE’s description of Protocol Tunneling (T1572), not a standalone technique named “NDR evasion.”
Which behaviors can obscure network activity?
| Behavior | How it can affect visibility | Defensive focus |
|---|---|---|
| Protocol tunneling (T1572) | Wraps one protocol inside another; traffic may blend with ordinary activity or add encryption. SSH forwarding is one example in MITRE’s technique description. | Investigate protocol and port mismatches, unexpected encapsulation, unusual process-to-network relationships, and asymmetric flow volumes. Filter risky destinations and consider network intrusion prevention where appropriate. |
| Encrypted channels (T1573) | Conceal command-and-control content within encrypted communications, limiting what payload inspection can reveal. | Assess flow metadata, destinations, timing, volume, connection behavior, and whether the traffic fits the asset’s role. Use endpoint context and authorized decryption policies where appropriate. |
| Proxies and multi-hop relays (T1090) | Intermediaries can obscure direct connections; a chain of relays can make tracing the original source more difficult. | Correlate unusual or sustained outbound sessions with asset role and other available telemetry; investigate the chain rather than treating the apparent destination as the origin. |
| Non-standard encoding (T1132) | Encoded command-and-control content can depart from expected protocol formats and frustrate content inspection. | Validate protocol conformance and normal application behavior, then assess deviations alongside traffic metadata and host evidence. |
| Disabling or modifying defenses and logs | Reducing collection or changing defensive tools can leave investigators with less evidence about network activity. | Monitor sensor health and logging configuration, alert on telemetry loss, and protect administrative access and change paths. |
These technique categories are described across MITRE ATT&CK’s Enterprise Techniques catalog and related technique material. They are useful ways to organize defensive thinking, not a claim that every NDR product observes or detects each behavior.
#1 Best Overall
- Compact and Efficient Design: The FortiGate 40F is designed for small to mid-sized businesses and enterprise branch offices, featuring a compact, fanless desktop form factor that ensures quiet operation and minimizes space usage.
- Robust Connectivity Options: Equipped with 5 GE RJ45 ports, including 1 WAN port and 4 internal ports, this model provides essential connectivity and flexibility for various network configurations in a small-scale environment.
- High-Performance Security: Offers up to 1 Gbps IPS throughput and 600 Mbps threat protection throughput, using Fortinet’s purpose-built security processor technology to deliver industry-leading performance and protection for SSL encrypted traffic.
- Advanced Threat Protection: Integrated with Fortinet’s AI-powered FortiGuard Labs, the FortiGate 40F offers comprehensive cybersecurity, identifying and mitigating both known and unknown threats to maintain robust security across your network.
- Simplified Management and Deployment: Features a user-friendly management console that provides comprehensive network automation and visibility, coupled with Zero Touch Integration with Fortinet’s Security Fabric for easy deployment.
What clues can remain when payloads are hidden?
Even when content cannot be read, defenders may still have evidence about who communicated, where, when, how often, and in what volume. Whether those clues are available depends on sensor placement, collection coverage, and the context that can be correlated with network records.
- Protocol and port fit: A protocol appearing on an unexpected port, or encrypted traffic on a service normally observed without encryption, can merit investigation.
- Flow shape: Unusual volume, timing, or asymmetry between the two directions of a connection can be a lead, particularly when it departs from the relevant asset’s baseline.
- Process and connection context: MITRE’s T1572 detection strategy gives examples of processes such as
plink.exe,ssh.exe, andnetsh.exeinitiating outbound connections with patterns that suggest encapsulated protocols. The process name alone does not establish malicious activity. - Unexpected protocol use: MITRE’s examples include DNS-over-HTTPS clients and tunneling from management-plane systems where that behavior is unexpected for the system’s role.
- Relay behavior: Sustained encrypted outbound traffic to anonymity infrastructure, or tools and relays initiating chained sessions, may warrant review in the context of approved use and other evidence.
- Gaps in collection: A sensor or log source becoming unavailable is itself a visibility issue to investigate, even if it does not by itself establish an attack.
These are investigation leads, not proof or an exhaustive signature list. Approved administration, remote access, privacy tools, sanctioned tunnels, and ordinary changes in software or network roles can produce overlapping observations. Validate an anomaly against software inventory, authorized activity, and the system’s expected function.
Rank #2
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
How should a defender investigate a suspected visibility gap?
- Confirm what the sensor actually observed. Establish which network path, asset, and time period are covered by the available records. A missing payload is different from a missing flow record, and neither alone explains why evidence is absent.
- Check whether the activity fits the asset. Compare the process, destination, protocol, port, timing, and traffic volume with the system’s role and established baseline. Pay particular attention to management-plane systems and unexpected outbound connections.
- Correlate other available evidence. Where collection permits, compare network records with endpoint or identity context, approved administration, and relevant logging. This can help distinguish a legitimate tunnel or relay from behavior that needs escalation.
- Test the suspected control failure. Review sensor health, logging configuration, and the administrative or change paths that could affect collection. Determine whether the loss of evidence is isolated or affects a broader network path.
- Contain and refine based on evidence. Apply destination filtering or network intrusion prevention when justified, and review whether segmentation or policy changes can reduce exposure. Check the resulting telemetry so a mitigation does not create an unobserved path.
Which controls improve NDR coverage?
No single measure guarantees that tunneling, encryption, proxying, encoding, or impaired logging will be detected or prevented. Layer controls so that the loss of one kind of visibility does not eliminate every useful signal.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Baseline expected behavior: Document normal protocols, destinations, flow sizes, and management-plane activity by asset role. Use deviations to prioritize investigation rather than treating every outlier as malicious.
- Filter destinations and inspect traffic: MITRE lists filtering traffic to untrusted or known-bad resources and using network intrusion prevention as measures relevant to tunneling. Destination blocking alone can be circumvented, so it should not be the only control.
- Segment networks: MITRE’s Network Sniffing (T1040) guidance includes segmentation to constrain access and reduce opportunities for sniffing or lateral visibility abuse.
- Protect data in transit: Encrypt sensitive traffic and use sound authentication practices. Encryption protects information in transit but also changes which payload details a sensor can inspect; content decryption should be policy-based, authorized, and appropriate to the environment.
- Preserve collection and context: Monitor sensors and logs for health, protect their configuration, and correlate network events with endpoint or identity evidence where available.
Coverage also depends on whether relevant network paths and assets are actually represented in collection. Review cloud, remote-user, east-west, management, and encrypted or tunneled paths against your environment’s needs; do not assume an NDR label alone guarantees visibility across them.
Rank #3
- 【Up to 1100 Mbps VPN Speed 】 Hardware-accelerated WireGuard and OpenVPN-DCO deliver up to 1100 Mbps VPN throughput, over 3× faster than Brume 2 for smooth remote access and file transfers.
- 【Three 2.5G Ports & Multi-WAN】Tri-port 2.5GbE design with flexible WAN LAN configuration supports multi-gigabit wired setups, dual-ISP Multi-WAN and failover to keep home and SOHO networks online.
- 【Stealth VPN Obfuscation】VPN obfuscation disguises VPN traffic as regular HTTPS, helping you evade blocking, bypass restrictive networks and maintain stable, private connections.
- 【DPI protection】Deep Packet Inspection with visual dashboards blocks adult/gambling/malicious sites, while SQM and QoS prioritize gaming, calls, and video when bandwidth is tight
- 【OpenWrt & USB 3.0 Expansion】OpenWrt with 1GB DDR4 and 8GB eMMC lets you install plugins and build VPN, ad-blocking or NAS, while USB 3.0 Type‑C connects high-speed storage or 4G/5G dongles
How can you assess defensive coverage without an “evasion-proof” claim?
When reviewing an NDR deployment or detection approach, assess the evidence it can collect and the work analysts can do with it, rather than relying on a blanket claim of resistance to evasion. MITRE’s strategies provide behavior-based examples, not a universal product capability rating.
- Visibility: What flow metadata and protocol parsing are available? How are encrypted connections handled, and can network evidence be correlated with endpoint or process context?
- Coverage: Which cloud, remote-user, east-west, management, and tunneled paths are represented by sensors or logs?
- Detection approach: Does the approach combine signatures, protocol-conformance checks, behavioral baselines, and evidence from other sources?
- Operational fit: Can analysts investigate alerts with useful context, manage false positives, and follow a defined response workflow? What deployment and maintenance work is required?
- Resilience: Are sensor health and missing telemetry monitored? Are logging and configuration protected, and can segmentation limit the impact of an unseen path?
These questions are evaluation criteria derived from MITRE’s detection and mitigation guidance, not measured comparisons of products.
What MITRE material supports this defensive view?
MITRE ATT&CK’s Protocol Tunneling (T1572) material describes tunneling and provides detection and mitigation examples. Its Enterprise Techniques catalog describes related behaviors including encrypted channels, proxies, and non-standard encoding. The Network Sniffing (T1040) page metadata reports version 1.7, created 2017-05-31 and last modified 2026-05-12; its guidance includes segmentation and encrypting sensitive information. These sources describe techniques and defensive approaches, not a prevalence rate or a guarantee that a given sensor will detect them.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
