domains / families / security / detecting-evasion-techniques-in-endpoint-logs

detecting-evasion-techniques-in-endpoint-logs

separate

'Detects defense evasion techniques used by adversaries in endpoint logs

When to use

• Hunting for adversary defense evasion techniques (MITRE ATT&CK TA0005) in endpoint telemetry
• Building detection rules for common evasion methods (process injection, timestomping, log clearing)
• Investigating incidents where adversaries disabled or bypassed security tools
• Analyzing endpoint logs for indicators of living-off-the-land binary (LOLBin) abuse

When not to use

• Network-level evasion
• Malware reverse engineering

Skill page

Source