Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.
["File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification"]
nist_csf
["PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01"]
Detecting Evasion Techniques in Endpoint Logs
When to Use
Use this skill when:
Hunting for adversary defense evasion techniques (MITRE ATT&CK TA0005) in endpoint telemetry
Building detection rules for common evasion methods (process injection, timestomping, log clearing)
Investigating incidents where adversaries disabled or bypassed security tools
Analyzing endpoint logs for indicators of living-off-the-land binary (LOLBin) abuse
Do not use this skill for network-level evasion (use network traffic analysis) or for malware reverse engineering.
Detection Gaps & Validation
Direct syscalls / unhooking defeat API-based rules: tools using direct or indirect syscalls (SysWhispers, Hell's Gate) or that unhook ntdll bypass userland EDR hooks, so CreateRemoteThread (Sysmon EID 8) may never fire. Backstop with Sysmon EID 10 (ProcessAccess to lsass, GrantedAccess 0x1010/0x1410) and ETW-Ti / kernel telemetry, not just hook-based detections.
Log source not actually enabled: evasion hunting silently fails if 4688 has no command line (ProcessCreationIncludeCmdLine_Enabled=1) or the Sysmon config excludes EID 8/10. The SwiftOnSecurity / Olaf Hartong base configs comment these out in places — confirm the events are present before trusting a clean hunt.
AMSI/ETW bypass blinds script logging:amsi.dll patching and ETW patching (ntdll!EtwEventWrite) suppress 4104 script-block and AMSI events. Treat 4104 text containing AmsiUtils/amsiInitFailed, or a sudden stop in PowerShell Operational events, as the detection itself.
Timestomping confirmed by correlation, not one event: compare Sysmon EID 2 (file-create-time changed) against EID 11 create time and $STANDARD_INFORMATION vs $FILE_NAME MFT timestamps.
Validate each rule fires: run the matching Atomic Red Team test — T1070.001 (wevtutil cl), T1562.001 (Set-MpPreference -DisableRealtimeMonitoring), T1055 (process injection), T1218 LOLBins (mshta/regsvr32/certutil) — and confirm the alert reaches the SIEM. Tune false positives with an allowlist of legitimate injectors (AV, accessibility tools) and parent-process context rather than disabling the rule.
Prerequisites
Sysmon installed and configured with comprehensive logging rules (SwiftOnSecurity or Olaf Hartong config)
Windows Security Event Log with advanced audit policy enabled
EDR telemetry (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint)
SIEM platform for log correlation (Splunk, Elastic, Sentinel)
MITRE ATT&CK Enterprise matrix for technique reference
Workflow
Step 1: Detect Log Tampering (T1070)
Windows Event Log clearing (T1070.001):
# Sysmon Event ID 1 (Process Create) for wevtutil
EventID: 1
CommandLine contains: "wevtutil cl" OR "wevtutil clear-log"
# Security Event ID 1102 - Audit log was cleared
EventID: 1102
Source: Microsoft-Windows-Eventlog
# System Event ID 104 - Event log was cleared
EventID: 104
# PowerShell log clearing
EventID: 1 (Sysmon)
CommandLine contains: "Clear-EventLog" OR "Remove-EventLog"
# Splunk query:
index=windows (EventCode=1102 OR EventCode=104)
OR (EventCode=1 CommandLine="*wevtutil*cl*")
OR (EventCode=1 CommandLine="*Clear-EventLog*")
| table _time host user CommandLine EventCode
Timestomping (T1070.006):
# Sysmon Event ID 2 - File creation time changed
EventID: 2
# Look for creation times set far in the past on recently-written files
# Correlate with Event ID 11 (FileCreate) - if FileCreate is recent but
# creation time in Event ID 2 is old, timestomping is likely
# MDE Advanced Hunting (KQL):
DeviceFileEvents
| where ActionType == "FileTimestampModified"
| where Timestamp > ago(7d)
| extend TimeDiff = datetime_diff('day', Timestamp, ReportedFileCreationTime)
| where TimeDiff > 30
| project Timestamp, DeviceName, FileName, FolderPath,
ReportedFileCreationTime, InitiatingProcessFileName
Step 2: Detect Process Injection (T1055)
# Sysmon Event ID 8 - CreateRemoteThread
EventID: 8
# Alert when source process is unusual (not system processes)
# Filter out known legitimate: antivirus, debugging tools
SourceImage NOT IN ("C:\Windows\System32\csrss.exe",
"C:\Windows\System32\lsass.exe")
# Sysmon Event ID 10 - ProcessAccess with suspicious access masks
EventID: 10
GrantedAccess contains: "0x1F0FFF" OR "0x1FFFFF" OR "0x001F0FFF"
# PROCESS_ALL_ACCESS = 0x1F0FFF (common in injection)
# Filter legitimate: AV accessing all processes
# Sysmon Event ID 25 - Process Tampering
EventID: 25
Type: "Image is replaced" # Process hollowing indicator
# Splunk detection:
index=sysmon EventCode=8
| where NOT match(SourceImage, "(?i)(csrss|svchost|MsMpEng|defender)")
| stats count by SourceImage TargetImage host
| where count < 5
| sort - count
Step 3: Detect Security Tool Disabling (T1562)
# Service stopped events for security services
EventID: 7045 (new service) OR 7036 (service state change)
ServiceName IN ("WinDefend", "Sense", "CrowdStrike Falcon Sensor",
"SentinelAgent", "csagent", "MBAMService")
# Sysmon Event ID 1 - Processes that disable Defender
CommandLine contains: "Set-MpPreference -DisableRealtimeMonitoring"
OR "sc stop WinDefend"
OR "sc config WinDefend start= disabled"
OR "net stop" AND ("windefend" OR "sense" OR "csagent")
# Registry modification to disable security features
# Sysmon Event ID 13 - Registry value set
TargetObject contains: "DisableAntiSpyware"
OR "DisableRealtimeMonitoring"
OR "DisableBehaviorMonitoring"
Details: "DWORD (0x00000001)"
# MDE KQL:
DeviceRegistryEvents
| where RegistryValueName in ("DisableAntiSpyware", "DisableRealtimeMonitoring")
| where RegistryValueData == "1"
| project Timestamp, DeviceName, RegistryKey, InitiatingProcessFileName
Step 4: Detect Masquerading (T1036)
# Sysmon Event ID 1 - Process with legitimate name from unusual path
EventID: 1
Image contains: "svchost.exe" AND Image NOT starts with: "C:\Windows\System32\"
Image contains: "csrss.exe" AND Image NOT starts with: "C:\Windows\System32\"
Image contains: "lsass.exe" AND Image NOT starts with: "C:\Windows\System32\"
# Process name mismatch (original filename vs. current name)
# Sysmon captures OriginalFileName from PE header
EventID: 1
OriginalFileName != (parsed filename from Image path)
# Double extension files
EventID: 11 (FileCreate)
TargetFilename matches: "*\.pdf\.exe" OR "*\.doc\.exe" OR "*\.jpg\.exe"
# Splunk:
index=sysmon EventCode=1
| eval process_name=mvindex(split(Image,"\\"),-1)
| where (process_name="svchost.exe" AND NOT match(Image,"(?i)C:\\\\Windows\\\\System32"))
OR (process_name="csrss.exe" AND NOT match(Image,"(?i)C:\\\\Windows\\\\System32"))
| table _time host Image ParentImage CommandLine User
Step 5: Detect LOLBin Abuse (T1218, T1127)
# Common LOLBin abuse patterns:
# mshta.exe executing remote content
EventID: 1
Image ends with: "mshta.exe"
CommandLine contains: "http" OR "javascript:" OR "vbscript:"
# certutil.exe downloading files
EventID: 1
Image ends with: "certutil.exe"
CommandLine contains: "-urlcache" OR "-decode" OR "-encode"
# regsvr32.exe executing scriptlets
EventID: 1
Image ends with: "regsvr32.exe"
CommandLine contains: "/s /n /u /i:" OR "scrobj.dll"
# rundll32.exe with unusual DLLs
EventID: 1
Image ends with: "rundll32.exe"
CommandLine contains: "javascript:" OR ".js" OR "http:"
# MSBuild executing inline tasks
EventID: 1
Image contains: "MSBuild.exe"
CommandLine NOT contains: ".sln" AND NOT contains: ".csproj"
Step 6: Build Detection Rule Correlation
# Combine multiple weak signals into high-confidence detection:
# Rule: Potential post-exploitation evasion chain
# Trigger when 3+ evasion techniques observed on same host within 1 hour
# Splunk correlation search:
index=sysmon host=*
| eval technique=case(
EventCode=2, "timestomping",
EventCode=8 AND NOT match(SourceImage,"csrss|svchost"), "process_injection",
EventCode=1 AND match(CommandLine,"(?i)wevtutil.*cl"), "log_clearing",
EventCode=13 AND match(TargetObject,"DisableRealtimeMonitoring"), "security_disable",
EventCode=1 AND match(CommandLine,"(?i)(mshta|certutil.*urlcache|regsvr32.*/s.*/n)"), "lolbin_abuse",
true(), NULL
)
| where isnotnull(technique)
| bin _time span=1h
| stats dc(technique) as technique_count values(technique) as techniques by host _time
| where technique_count >= 3
| sort - technique_count
Key Concepts
Term
Definition
Defense Evasion (TA0005)
MITRE ATT&CK tactic where adversaries attempt to avoid detection during operations
Process Injection (T1055)
Technique of injecting code into another process's memory space to execute in a trusted context
Timestomping (T1070.006)
Modifying file timestamps to make malicious files appear old and blend with legitimate files
Masquerading (T1036)
Naming malicious files or processes to match legitimate system files to avoid detection
LOLBin
Living Off the Land Binary; legitimate Windows tool repurposed by adversaries
Indicator Removal (T1070)
Clearing logs, deleting files, or modifying artifacts to remove evidence of compromise
Tools & Systems
Sysmon: Advanced Windows system monitoring with kernel-level visibility
Microsoft Defender for Endpoint: EDR with advanced hunting (KQL) for evasion detection
CrowdStrike Falcon: IOA-based behavioral detection for evasion techniques
Elastic Security: SIEM with prebuilt detection rules for ATT&CK evasion techniques
Sigma Rules: Vendor-agnostic detection rule format with extensive evasion rule library
Common Pitfalls
Alert fatigue from process injection rules: Many legitimate tools (AV, accessibility) perform process injection. Maintain an allowlist of known-good source processes.
Missing Sysmon Event ID 8/10: Default Sysmon configurations may not capture CreateRemoteThread or ProcessAccess. Use a comprehensive Sysmon config.
Ignoring parent process context: A suspicious command line from cmd.exe is concerning only if the parent of cmd.exe is unusual (e.g., Excel spawning cmd.exe).
Not correlating across event types: Single events are often benign. Combine multiple weak signals (process creation + network connection + file creation) for high-confidence detections.
