skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-evasion-techniques-in-endpoint-logs

Detects defense evasion techniques in endpoint logs using Sysmon, Windows events, and SIEM queries.

954|172|Updated Mar 13, 2026
Search Tags:#threat hunting#endpoint security#siem#sysmon#mitre att&ck#defense evasion#detection engineering
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-evasion-techniques-in-endpoint-logs
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-evasion-techniques-in-endpoint-logs
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/endpoint-security/detecting-evasion-techniques-in-endpoint-logs
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-evasion-techniques-in-endpoint-logs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Adversaries routinely evade detection by clearing logs, timestomping files, injecting into processes, and disabling security tools, leaving analysts with blind spots. This Skill provides concrete detection logic, event IDs, and SIEM queries to surface MITRE ATT&CK TA0005 defense evasion activity in endpoint telemetry.

Core Features & Use Cases

  • Evasion Detection Queries: Ready-to-use Sysmon, Splunk, and KQL detections for log tampering (T1070), process injection (T1055), security tool disabling (T1562), masquerading (T1036), and LOLBin abuse (T1218).
  • Detection Gap Guidance: Identifies blind spots such as direct syscalls bypassing userland hooks, AMSI/ETW patching suppressing script logs, and misconfigured Sysmon or audit policies.
  • Correlation Logic: Combines multiple weak evasion signals into high-confidence alerts, such as flagging hosts with 3+ evasion techniques within one hour.
  • Use Case: A threat hunter investigating a stealthy intrusion uses the Skill to build Splunk searches for wevtutil log clearing, Sysmon EID 8 CreateRemoteThread events, and Defender tampering registry keys, then validates each rule with Atomic Red Team tests.

Quick Start

Ask the AI to build detection rules for process injection and log clearing in your Sysmon and Splunk environment using this skill.

Frequently Asked Questions about detecting-evasion-techniques-in-endpoint-logs

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect process injection in Windows endpoint logs?▼

Detect process injection using Sysmon Event ID 8 (CreateRemoteThread) filtered to exclude legitimate source processes, and Event ID 10 (ProcessAccess) with access masks like 0x1F0FFF. Sysmon Event ID 25 also flags process hollowing where an image is replaced.

How to detect Windows event log clearing by attackers?▼

Detect log clearing with Security Event ID 1102 and System Event ID 104, plus Sysmon Event ID 1 for commands like wevtutil cl, Clear-EventLog, or Remove-EventLog. A Splunk query combining these event codes with command-line matching surfaces tampering attempts.

Why does my Sysmon setup miss process injection events?▼

Default Sysmon configurations often exclude Event IDs 8 and 10, and direct syscalls or ntdll unhooking bypass userland EDR hooks entirely. Use a comprehensive config like SwiftOnSecurity or Olaf Hartong and backstop with kernel telemetry or ETW-Ti.

Can timestomping be detected with Sysmon?▼

Yes, Sysmon Event ID 2 records file creation time changes, which you correlate against Event ID 11 file creation times and MFT $STANDARD_INFORMATION versus $FILE_NAME timestamps. A large gap between reported creation time and actual write time indicates timestomping.

What are common false positives in evasion detection rules?▼

Legitimate antivirus, accessibility tools, and debugging software perform process injection and broad process access, triggering Event ID 8 and 10 alerts. Maintain an allowlist of known-good source processes and use parent-process context rather than disabling the rules.

When should I not use endpoint log analysis for evasion detection?▼

Endpoint log analysis does not cover network-level evasion, which requires network traffic analysis, or malware reverse engineering. It also fails silently if audit policies or Sysmon logging for the relevant event IDs are not enabled first.

Related Skills

Explore More Software Engineering Skills→
OpenTideHQOpenTideHQ
4

windows-event-logs

Document Windows-native telemetry sources and audit policy prerequisites for detection engineering.

Official
Advanced
jfrometajfrometa

red-team-tactics

Map adversary techniques to MITRE ATT&CK phases for red-team simulations.

Community
Basic
balsm-healthbalsm-health
2

extracting-iocs-from-malware-samples

Extract file hashes, network indicators, and host artifacts from malware samples.

Official
Advanced
SnailSploitSnailSploit
2.9k

edr-evasion

Evade EDR systems using hook unhooking, direct syscalls, and AMSI bypass.

Community
Advanced