In 2026, the loud, noisy attacks that light up every alert in your EDR and SIEM are becoming less common among sophisticated actors. The new gold standard is patience, the ability to move slowly, blend in, and stay invisible for weeks or months while achieving the mission.
Modern EDR and SIEM systems are excellent at catching spikes in activity, unusual processes, or known malicious signatures. What they still struggle with is the quiet, disciplined attacker who understands that speed is the enemy of stealth.
How Patience-Based Attacks Work
The core philosophy is simple: do less, but do it smarter.
The traditional approach of "land, scan, exploit, exfil" is very fast and aggressive; however, some attackers prefer a much slower approach.
1. Initial Access Using the Least Amount of Footprint: These attackers generally get into the environment by using legitimate credentials, whether phished or stolen from EvilTokens, living off the land (using binaries already on the system) and using dropper files that look like normal activity on a system.
2. Long Dwell Time with Minimal Noise: Once in the environment, they do not create a lot of noise or activity that might alert administrators. They do not perform reconnaissance using noisy tools or applications; instead, they use native Windows tools (PowerShell, WMI, net.exe, and whoami) in small bursts of time and only use one tool at a time. Additionally, these attackers will also have very long periods of time (hours or days) between actions, and they will do their best to try to remain inconspicuous and blend themselves into the activities of the normal users or administrators within the organization.
3. Gradual Discovery and Mapping: These attackers will discover and map out their environment slowly - e.g., they will perform a few Active Directory queries or a few file accesses at a time and never trigger any volume-based alerts.
4. Collection of Data Without Obvious Exfil: These attackers will first collect the data locally, then compress and stage the data for exfiltration, and finally exfiltrate the data in very small and irregular increments over a very long period of time, often disguising their activity as normal traffic (e.g., OneDrive sync, legitimate API calls, DNS).
5. Persistence Without Obvious Artifacts: These attackers prefer to use legitimate persistence mechanisms (e.g., scheduled tasks, WMI event subscriptions, logon scripts) instead of obvious mechanisms (e.g., registry run keys or services), which would leave obvious artifacts behind.
Methods That Attackers Use to Remain in the Shadows
1. Randomness/Jitter - They will insert random delays (from 5 minutes to 48 hours) between their actions so that they cannot be detected by patterns.
2. Living Off the Land (LOLBins) - They only leverage built-in Windows tools (i.e. powershell.exe, cmd.exe, rundll32.exe, certutil.exe) that normal users are expected to run.
3. Process Injection/Hollowing - They will inject into legitimate running processes (e.g. explorer.exe & svchost.exe) to hide and conceal their malicious activities.
4. Fileless Execution Running payloads entirely in memory or via reflective DLL injection.
5. Slow Data Staging Copying files to a staging directory over days, then exfiltrating in tiny encrypted pieces mixed with normal traffic.
Why Modern EDR & SIEM Still Struggle
Most EDR solutions are tuned for speed and volume, they excel at catching rapid ransomware or noisy malware. Patient attackers operate below those thresholds. They generate so little noise that many behavioral rules never trigger.
SIEM systems suffer from the same problem: when you have millions of events per day, the subtle, spaced-out actions of a patient attacker easily get lost in the noise.
Practical Detection Strategies That Actually Work
1. Focus on Baselines, Not Just Anomalies Build strong baselines of normal behavior for each user and device, then look for subtle deviations over time.
2. Hunt for “Low and Slow” Patterns Look for processes that show periodic, low-volume activity over long periods (e.g., PowerShell making one suspicious connection every 4–6 hours).
3. Monitor for LOLBin Utilization Maintain a log to record the usage of LOLBINS (powershell.exe when utilizing the -EncodedCommand switch, certutil/URL cache (cached files) and others) for unusual command-line arguments as another indicator of LOLBin use (e.g., using LOLBins on an organization’s users).
4. Monitoring for Data Staging Behavior Document any unusual activity pertaining to file copying or archiving that happens before delayed/batched outbound traffic.
5. Use Memory and Behavioral Analytics Modern EDR that looks at process injection, memory anomalies, and parent-child process relationships is more effective than signature-based detection.
Bottom Line
The attackers who are hardest to catch in 2026 are not the loudest, they are the most patient. They have learned that in a world full of noisy alerts, the best way to stay invisible is to move slowly, use legitimate tools, and never generate the volume that triggers rules.
Defense against them requires a shift in mindset: from chasing spikes to understanding normal behavior and hunting for subtle, persistent anomalies over time.
The art of staying invisible is now one of the most important skills in the attacker’s playbook. Understanding that art is becoming equally important for defenders.
