detecting-evasion-techniques-in-endpoint-logs

# Detecting Evasion Techniques in Endpoint Logs ## When to Use Use this skill when: - Hunting for adversary defense evasion techniques (MITRE ATT&CK TA0005) in endpoint telemetry - Building detection rules for common evasion methods (process injection, timestomping, log clearing) - Investigating incidents where adversaries disabled or bypassed security tools - Analyzing endpoint logs for indicators of living-off-the-land binary (LOLBin) abuse **Do not use** this skill for network-level evasion (use network traffic analysis) or for malware reverse engineering. ## Prerequisites - Sysmon installed and configured with comprehensive logging rules (SwiftOnSecurity or Olaf Hartong config) - Windows Security Event Log with advanced audit policy enabled - EDR telemetry (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint) - SIEM platform for log correlation (Splunk, Elastic, Sentinel) - MITRE ATT&CK Enterprise matrix for technique reference ## Workflow ### Step 1: Detect Log Tampering (T1070) **Windows Event Log clearing (T1070.001)**: ``` # Sysmon Event ID 1 (Process Create) for wevtutil EventID: 1 CommandLine contains: "wevtutil cl" OR "wevtutil clear-log" # Security Event ID 1102 - Audit log was cleared EventID: 1102 Source: Microsoft-Windows-Eventlog # System Event ID 104 - Event log was cleared EventID: 104 # PowerShell log clearing EventID: 1 (Sysmon) CommandLine contains: "Clear-EventLog" OR "Remove-EventLog" # Splunk query: index=windows (EventCode=1102 OR Ev...