detecting-evasion-techniques-in-endpoint-logs

name	detecting-evasion-techniques-in-endpoint-logs
description	Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.
domain	cybersecurity
subdomain	endpoint-security
tags	["endpoint","edr","threat-hunting","defense-evasion","MITRE-ATT&CK","detection-engineering"]
version	1.0.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification"]
nist_csf	["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]
mitre_attack	["T1055","T1547","T1059","T1036","T1027"]

Detecting Evasion Techniques in Endpoint Logs

When to Use

Use this skill when:

• Hunting for adversary defense evasion techniques (MITRE ATT&CK TA0005) in endpoint telemetry
• Building detection rules for common evasion methods (process injection, timestomping, log clearing)
• Investigating incidents where adversaries disabled or bypassed security tools
• Analyzing endpoint logs for indicators of living-off-the-land binary (LOLBin) abuse

Do not use this skill for network-level evasion (use network traffic analysis) or for malware reverse engineering.

Prerequisites

• Sysmon installed and configured with comprehensive logging rules (SwiftOnSecurity or Olaf Hartong config)
• Windows Security Event Log with advanced audit policy enabled
• EDR telemetry (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint)
• SIEM platform for log correlation (Splunk, Elastic, Sentinel)
• MITRE ATT&CK Enterprise matrix for technique reference

Workflow

Step 1: Detect Log Tampering (T1070)

Windows Event Log clearing (T1070.001):

# Sysmon Event ID 1 (Process Create) for wevtutil
EventID: 1
CommandLine contains: "wevtutil cl" OR "wevtutil clear-log"

# Security Event ID 1102 - Audit log was cleared
EventID: 1102
Source: Microsoft-Windows-Eventlog

# System Event ID 104 - Event log was cleared
EventID: 104

# PowerShell log clearing
EventID: 1 (Sysmon)
CommandLine contains: "Clear-EventLog" OR "Remove-EventLog"

# Splunk query:
index=windows (EventCode=1102 OR EventCode=104)
  OR (EventCode=1 CommandLine="*wevtutil*cl*")
  OR (EventCode=1 CommandLine="*Clear-EventLog*")
| table _time host user CommandLine EventCode

Timestomping (T1070.006):

# Sysmon Event ID 2 - File creation time changed
EventID: 2
# Look for creation times set far in the past on recently-written files
# Correlate with Event ID 11 (FileCreate) - if FileCreate is recent but
# creation time in Event ID 2 is old, timestomping is likely

# MDE Advanced Hunting (KQL):
DeviceFileEvents
| where ActionType == "FileTimestampModified"
| where Timestamp > ago(7d)
| extend TimeDiff = datetime_diff('day', Timestamp, ReportedFileCreationTime)
| where TimeDiff > 30
| project Timestamp, DeviceName, FileName, FolderPath,
    ReportedFileCreationTime, InitiatingProcessFileName

Step 2: Detect Process Injection (T1055)

# Sysmon Event ID 8 - CreateRemoteThread
EventID: 8
# Alert when source process is unusual (not system processes)
# Filter out known legitimate: antivirus, debugging tools
SourceImage NOT IN ("C:\Windows\System32\csrss.exe",
                     "C:\Windows\System32\lsass.exe")

# Sysmon Event ID 10 - ProcessAccess with suspicious access masks
EventID: 10
GrantedAccess contains: "0x1F0FFF" OR "0x1FFFFF" OR "0x001F0FFF"
# PROCESS_ALL_ACCESS = 0x1F0FFF (common in injection)
# Filter legitimate: AV accessing all processes

# Sysmon Event ID 25 - Process Tampering
EventID: 25
Type: "Image is replaced"  # Process hollowing indicator

# Splunk detection:
index=sysmon EventCode=8
| where NOT match(SourceImage, "(?i)(csrss|svchost|MsMpEng|defender)")
| stats count by SourceImage TargetImage host
| where count < 5
| sort - count