Anti-Forensics
Account Misuse
Clear Browser Artifacts
Clear Email Artifacts
Code Contribution Obfuscation and Misrepresentation
Decrease Privileges
Delayed Execution Triggers
Delete User Account
Deletion of Volume Shadow Copy
Disk Wiping
File Deletion
File Encryption
Hide Artifacts
Hiding or Destroying Command History
Log Deletion
Log Modification
Message Deletion
Modify Windows Registry
Network Obfuscation
Physical Destruction of Storage Media
Physical Removal of Disk Storage
Stalling
Steganography
System Shutdown
Timestomping
Tripwires
Uninstalling Software
Virtualization
Windows System Time Modification
- ID: AF031.003
- Created: 21st March 2026
- Updated: 27th March 2026
- Contributor: The ITM Team
Concealment of Functionality Within Benign Changes
A subject embeds harmful, unauthorized, or non-compliant logic within otherwise legitimate or unrelated code changes, reducing the likelihood that it is identified during review.
This may involve placing malicious or sensitive functionality within large refactors, feature updates, or routine maintenance changes, where the volume or complexity of modifications limits detailed inspection. The concealed logic is often designed to blend with surrounding code, using naming conventions, structure, or patterns consistent with legitimate development.
This behavior exploits reviewer attention constraints and increases the probability that harmful functionality is accepted as part of a broader, seemingly valid change set.