Adversaries are increasingly favoring stealth versus overt exploits, using legitimate system tools, stolen credentials and encrypted communications to remain undetected.