A parks IT tabletop covers how adversaries stage payloads to reduce defensive hits on municipal Windows hosts. Which evasion concept should analysts recognize?

Parks IT tabletop exercises should teach that adversaries often stage payloads where routine scanners look least carefully. Alternate data streams (ADS) on NTFS and uncommon paths (unusual profile subfolders, temp-like locations outside standard AV focus lists, or rarely audited shares) reduce hits from scanning patterns that emphasize well-known directories and primary file streams. Analysts recognizing this evasion concept can expand hunt scopes, include ADS-aware tooling, and verify that municipal Windows host policies cover non-obvious staging locations—not only Desktop and Downloads.

Publishing every payload hash on the public website is neither an adversary staging technique nor sound defensive practice; it discloses indicators without addressing where files hide. Disabling municipal logging removes visibility defenders need and is not an evasion concept the tabletop should normalize as adversary tradecraft for parks endpoints. Relying solely on weekly full-disk antivirus scans without attention to staging locations leaves long dwell windows and may miss ADS or path tricks that targeted, continuous, or path-aware scanning would catch.

Exam caveat: the question asks which evasion concept analysts should recognize when adversaries stage payloads to reduce defensive hits—not which civic transparency or logging policy is preferred. Choose the staging/hiding concept, not a broken operational practice framed as humor.

Operational check: on a parks lab Windows image under ROE, place a benign marker in an ADS and in an uncommon path, run the same scanners used in production baselines, and record whether alerts fire. Update hunt playbooks to include ADS enumeration and non-standard path review so municipal analysts do not assume clean AV dashboards mean clean hosts.