[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73ASZ6NJRJM44Z2P84NGQ3Q":3,"skill-same:01M73ASZ6NJRJM44Z2P84NGQ3Q":114},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":56,"commitSha":57,"skillDirectory":58,"forksCount":59,"repositoryHtmlUrl":60,"repositoryHomepageUrl":61,"ownerHtmlUrl":62,"ownerBlogUrl":63,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs",null,"Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: detecting-evasion-techniques-in-endpoint-logs\ndescription: 'Detects defense evasion techniques used by adversaries in endpoint logs\n  including log tampering, timestomping, process injection, and security tool disabling.\n  Use when investigating suspicious endpoint behavior, building detection rules for\n  evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates\n  for requests involving evasion detection, defense evasion analysis, log tampering\n  detection, or MITRE ATT&CK TA0005.\n\n  '\ndomain: cybersecurity\nsubdomain: endpoint-security\ntags:\n- endpoint\n- edr\n- threat-hunting\n- defense-evasion\n- MITRE-ATT&CK\n- detection-engineering\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- File Metadata Consistency Validation\n- Content Format Conversion\n- File Content Analysis\n- Platform Hardening\n- File Format Verification\nnist_csf:\n- PR.PS-01\n- PR.PS-02\n- DE.CM-01\n- PR.IR-01\nmitre_attack:\n- T1055\n- T1547\n- T1059\n- T1036\n- T1027\nsource: https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\nsource_commit: 04450304b12645cb2b974ab96d28c0664758a88d\n---\n# Detecting Evasion Techniques in Endpoint Logs\n\n## When to Use\n\nUse this skill when:\n- Hunting for adversary defense evasion techniques (MITRE ATT&CK TA0005) in endpoint telemetry\n- Building detection rules for common evasion methods (process injection, timestomping, log clearing)\n- Investigating incidents where adversaries disabled or bypassed security tools\n- Analyzing endpoint logs for indicators of living-off-the-land binary (LOLBin) abuse\n\n**Do not use** this skill for network-level evasion (use network traffic analysis) or for malware reverse engineering.\n\n## Prerequisites\n\n- Sysmon installed and configured with comprehensive logging rules (SwiftOnSecurity or Olaf Hartong config)\n- Windows Security Event Log with advanced audit policy enabled\n- EDR telemetry (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint)\n- SIEM platform for log correlation (Splunk, Elastic, Sentinel)\n- MITRE ATT&CK Enterprise matrix for technique reference\n\n## Workflow\n\n### Step 1: Detect Log Tampering (T1070)\n\n**Windows Event Log clearing (T1070.001)**:\n```\n# Sysmon Event ID 1 (Process Create) for wevtutil\nEventID: 1\nCommandLine contains: \"wevtutil cl\" OR \"wevtutil clear-log\"\n\n# Security Event ID 1102 - Audit log was cleared\nEventID: 1102\nSource: Microsoft-Windows-Eventlog\n\n# System Event ID 104 - Event log was cleared\nEventID: 104\n\n# PowerShell log clearing\nEventID: 1 (Sysmon)\nCommandLine contains: \"Clear-EventLog\" OR \"Remove-EventLog\"\n\n# Splunk query:\nindex=windows (EventCode=1102 OR EventCode=104)\n  OR (EventCode=1 CommandLine=\"*wevtutil*cl*\")\n  OR (EventCode=1 CommandLine=\"*Clear-EventLog*\")\n| table _time host user CommandLine EventCode\n```\n\n**Timestomping (T1070.006)**:\n```\n# Sysmon Event ID 2 - File creation time changed\nEventID: 2\n# Look for creation times set far in the past on recently-written files\n# Correlate with Event ID 11 (FileCreate) - if FileCreate is recent but\n# creation time in Event ID 2 is old, timestomping is likely\n\n# MDE Advanced Hunting (KQL):\nDeviceFileEvents\n| where ActionType == \"FileTimestampModified\"\n| where Timestamp > ago(7d)\n| extend TimeDiff = datetime_diff('day', Timestamp, ReportedFileCreationTime)\n| where TimeDiff > 30\n| project Timestamp, DeviceName, FileName, FolderPath,\n    ReportedFileCreationTime, InitiatingProcessFileName\n```\n\n### Step 2: Detect Process Injection (T1055)\n\n```\n# Sysmon Event ID 8 - CreateRemoteThread\nEventID: 8\n# Alert when source process is unusual (not system processes)\n# Filter out known legitimate: antivirus, debugging tools\nSourceImage NOT IN (\"C:\\Windows\\System32\\csrss.exe\",\n                     \"C:\\Windows\\System32\\lsass.exe\")\n\n# Sysmon Event ID 10 - ProcessAccess with suspicious access masks\nEventID: 10\nGrantedAccess contains: \"0x1F0FFF\" OR \"0x1FFFFF\" OR \"0x001F0FFF\"\n# PROCESS_ALL_ACCESS = 0x1F0FFF (common in injection)\n# Filter legitimate: AV accessing all processes\n\n# Sysmon Event ID 25 - Process Tampering\nEventID: 25\nType: \"Image is replaced\"  # Process hollowing indicator\n\n# Splunk detection:\nindex=sysmon EventCode=8\n| where NOT match(SourceImage, \"(?i)(csrss|svchost|MsMpEng|defender)\")\n| stats count by SourceImage TargetImage host\n| where count \u003C 5\n| sort - count\n```\n\n### Step 3: Detect Security Tool Disabling (T1562)\n\n```\n# Service stopped events for security services\nEventID: 7045 (new service) OR 7036 (service state change)\nServiceName IN (\"WinDefend\", \"Sense\", \"CrowdStrike Falcon Sensor\",\n                 \"SentinelAgent\", \"csagent\", \"MBAMService\")\n\n# Sysmon Event ID 1 - Processes that disable Defender\nCommandLine contains: \"Set-MpPreference -DisableRealtimeMonitoring\"\n  OR \"sc stop WinDefend\"\n  OR \"sc config WinDefend start= disabled\"\n  OR \"net stop\" AND (\"windefend\" OR \"sense\" OR \"csagent\")\n\n# Registry modification to disable security features\n# Sysmon Event ID 13 - Registry value set\nTargetObject contains: \"DisableAntiSpyware\"\n  OR \"DisableRealtimeMonitoring\"\n  OR \"DisableBehaviorMonitoring\"\nDetails: \"DWORD (0x00000001)\"\n\n# MDE KQL:\nDeviceRegistryEvents\n| where RegistryValueName in (\"DisableAntiSpyware\", \"DisableRealtimeMonitoring\")\n| where RegistryValueData == \"1\"\n| project Timestamp, DeviceName, RegistryKey, InitiatingProcessFileName\n```\n\n### Step 4: Detect Masquerading (T1036)\n\n```\n# Sysmon Event ID 1 - Process with legitimate name from unusual path\nEventID: 1\nImage contains: \"svchost.exe\" AND Image NOT starts with: \"C:\\Windows\\System32\\\"\nImage contains: \"csrss.exe\" AND Image NOT starts with: \"C:\\Windows\\System32\\\"\nImage contains: \"lsass.exe\" AND Image NOT starts with: \"C:\\Windows\\System32\\\"\n\n# Process name mismatch (original filename vs. current name)\n# Sysmon captures OriginalFileName from PE header\nEventID: 1\nOriginalFileName != (parsed filename from Image path)\n\n# Double extension files\nEventID: 11 (FileCreate)\nTargetFilename matches: \"*\\.pdf\\.exe\" OR \"*\\.doc\\.exe\" OR \"*\\.jpg\\.exe\"\n\n# Splunk:\nindex=sysmon EventCode=1\n| eval process_name=mvindex(split(Image,\"\\\\\"),-1)\n| where (process_name=\"svchost.exe\" AND NOT match(Image,\"(?i)C:\\\\\\\\Windows\\\\\\\\System32\"))\n  OR (process_name=\"csrss.exe\" AND NOT match(Image,\"(?i)C:\\\\\\\\Windows\\\\\\\\System32\"))\n| table _time host Image ParentImage CommandLine User\n```\n\n### Step 5: Detect LOLBin Abuse (T1218, T1127)\n\n```\n# Common LOLBin abuse patterns:\n\n# mshta.exe executing remote content\nEventID: 1\nImage ends with: \"mshta.exe\"\nCommandLine contains: \"http\" OR \"javascript:\" OR \"vbscript:\"\n\n# certutil.exe downloading files\nEventID: 1\nImage ends with: \"certutil.exe\"\nCommandLine contains: \"-urlcache\" OR \"-decode\" OR \"-encode\"\n\n# regsvr32.exe executing scriptlets\nEventID: 1\nImage ends with: \"regsvr32.exe\"\nCommandLine contains: \"\u002Fs \u002Fn \u002Fu \u002Fi:\" OR \"scrobj.dll\"\n\n# rundll32.exe with unusual DLLs\nEventID: 1\nImage ends with: \"rundll32.exe\"\nCommandLine contains: \"javascript:\" OR \".js\" OR \"http:\"\n\n# MSBuild executing inline tasks\nEventID: 1\nImage contains: \"MSBuild.exe\"\nCommandLine NOT contains: \".sln\" AND NOT contains: \".csproj\"\n```\n\n### Step 6: Build Detection Rule Correlation\n\n```\n# Combine multiple weak signals into high-confidence detection:\n\n# Rule: Potential post-exploitation evasion chain\n# Trigger when 3+ evasion techniques observed on same host within 1 hour\n\n# Splunk correlation search:\nindex=sysmon host=*\n| eval technique=case(\n    EventCode=2, \"timestomping\",\n    EventCode=8 AND NOT match(SourceImage,\"csrss|svchost\"), \"process_injection\",\n    EventCode=1 AND match(CommandLine,\"(?i)wevtutil.*cl\"), \"log_clearing\",\n    EventCode=13 AND match(TargetObject,\"DisableRealtimeMonitoring\"), \"security_disable\",\n    EventCode=1 AND match(CommandLine,\"(?i)(mshta|certutil.*urlcache|regsvr32.*\u002Fs.*\u002Fn)\"), \"lolbin_abuse\",\n    true(), NULL\n)\n| where isnotnull(technique)\n| bin _time span=1h\n| stats dc(technique) as technique_count values(technique) as techniques by host _time\n| where technique_count >= 3\n| sort - technique_count\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Defense Evasion (TA0005)** | MITRE ATT&CK tactic where adversaries attempt to avoid detection during operations |\n| **Process Injection (T1055)** | Technique of injecting code into another process's memory space to execute in a trusted context |\n| **Timestomping (T1070.006)** | Modifying file timestamps to make malicious files appear old and blend with legitimate files |\n| **Masquerading (T1036)** | Naming malicious files or processes to match legitimate system files to avoid detection |\n| **LOLBin** | Living Off the Land Binary; legitimate Windows tool repurposed by adversaries |\n| **Indicator Removal (T1070)** | Clearing logs, deleting files, or modifying artifacts to remove evidence of compromise |\n\n## Tools & Systems\n\n- **Sysmon**: Advanced Windows system monitoring with kernel-level visibility\n- **Microsoft Defender for Endpoint**: EDR with advanced hunting (KQL) for evasion detection\n- **CrowdStrike Falcon**: IOA-based behavioral detection for evasion techniques\n- **Elastic Security**: SIEM with prebuilt detection rules for ATT&CK evasion techniques\n- **Sigma Rules**: Vendor-agnostic detection rule format with extensive evasion rule library\n\n## Common Pitfalls\n\n- **Alert fatigue from process injection rules**: Many legitimate tools (AV, accessibility) perform process injection. Maintain an allowlist of known-good source processes.\n- **Missing Sysmon Event ID 8\u002F10**: Default Sysmon configurations may not capture CreateRemoteThread or ProcessAccess. Use a comprehensive Sysmon config.\n- **Ignoring parent process context**: A suspicious command line from cmd.exe is concerning only if the parent of cmd.exe is unusual (e.g., Excel spawning cmd.exe).\n- **Not correlating across event types**: Single events are often benign. Combine multiple weak signals (process creation + network connection + file creation) for high-confidence detections.\n","# Detecting Evasion Techniques in Endpoint Logs\n\n## When to Use\n\nUse this skill when:\n- Hunting for adversary defense evasion techniques (MITRE ATT&CK TA0005) in endpoint telemetry\n- Building detection rules for common evasion methods (process injection, timestomping, log clearing)\n- Investigating incidents where adversaries disabled or bypassed security tools\n- Analyzing endpoint logs for indicators of living-off-the-land binary (LOLBin) abuse\n\n**Do not use** this skill for network-level evasion (use network traffic analysis) or for malware reverse engineering.\n\n## Prerequisites\n\n- Sysmon installed and configured with comprehensive logging rules (SwiftOnSecurity or Olaf Hartong config)\n- Windows Security Event Log with advanced audit policy enabled\n- EDR telemetry (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint)\n- SIEM platform for log correlation (Splunk, Elastic, Sentinel)\n- MITRE ATT&CK Enterprise matrix for technique reference\n\n## Workflow\n\n### Step 1: Detect Log Tampering (T1070)\n\n**Windows Event Log clearing (T1070.001)**:\n```\n# Sysmon Event ID 1 (Process Create) for wevtutil\nEventID: 1\nCommandLine contains: \"wevtutil cl\" OR \"wevtutil clear-log\"\n\n# Security Event ID 1102 - Audit log was cleared\nEventID: 1102\nSource: Microsoft-Windows-Eventlog\n\n# System Event ID 104 - Event log was cleared\nEventID: 104\n\n# PowerShell log clearing\nEventID: 1 (Sysmon)\nCommandLine contains: \"Clear-EventLog\" OR \"Remove-EventLog\"\n\n# Splunk query:\nindex=windows (EventCode=1102 OR EventCode=104)\n  OR (EventCode=1 CommandLine=\"*wevtutil*cl*\")\n  OR (EventCode=1 CommandLine=\"*Clear-EventLog*\")\n| table _time host user CommandLine EventCode\n```\n\n**Timestomping (T1070.006)**:\n```\n# Sysmon Event ID 2 - File creation time changed\nEventID: 2\n# Look for creation times set far in the past on recently-written files\n# Correlate with Event ID 11 (FileCreate) - if FileCreate is recent but\n# creation time in Event ID 2 is old, timestomping is likely\n\n# MDE Advanced Hunting (KQL):\nDeviceFileEvents\n| where ActionType == \"FileTimestampModified\"\n| where Timestamp > ago(7d)\n| extend TimeDiff = datetime_diff('day', Timestamp, ReportedFileCreationTime)\n| where TimeDiff > 30\n| project Timestamp, DeviceName, FileName, FolderPath,\n    ReportedFileCreationTime, InitiatingProcessFileName\n```\n\n### Step 2: Detect Process Injection (T1055)\n\n```\n# Sysmon Event ID 8 - CreateRemoteThread\nEventID: 8\n# Alert when source process is unusual (not system processes)\n# Filter out known legitimate: antivirus, debugging tools\nSourceImage NOT IN (\"C:\\Windows\\System32\\csrss.exe\",\n                     \"C:\\Windows\\System32\\lsass.exe\")\n\n# Sysmon Event ID 10 - ProcessAccess with suspicious access masks\nEventID: 10\nGrantedAccess contains: \"0x1F0FFF\" OR \"0x1FFFFF\" OR \"0x001F0FFF\"\n# PROCESS_ALL_ACCESS = 0x1F0FFF (common in injection)\n# Filter legitimate: AV accessing all processes\n\n# Sysmon Event ID 25 - Process Tampering\nEventID: 25\nType: \"Image is replaced\"  # Process hollowing indicator\n\n# Splunk detection:\nindex=sysmon EventCode=8\n| where NOT match(SourceImage, \"(?i)(csrss|svchost|MsMpEng|defender)\")\n| stats count by SourceImage TargetImage host\n| where count \u003C 5\n| sort - count\n```\n\n### Step 3: Detect Security Tool Disabling (T1562)\n\n```\n# Service stopped events for security services\nEventID: 7045 (new service) OR 7036 (service state change)\nServiceName IN (\"WinDefend\", \"Sense\", \"CrowdStrike Falcon Sensor\",\n                 \"SentinelAgent\", \"csagent\", \"MBAMService\")\n\n# Sysmon Event ID 1 - Processes that disable Defender\nCommandLine contains: \"Set-MpPreference -DisableRealtimeMonitoring\"\n  OR \"sc stop WinDefend\"\n  OR \"sc config WinDefend start= disabled\"\n  OR \"net stop\" AND (\"windefend\" OR \"sense\" OR \"csagent\")\n\n# Registry modification to disable security features\n# Sysmon Event ID 13 - Registry value set\nTargetObject contains: \"DisableAntiSpyware\"\n  OR \"DisableRealtimeMonitoring\"\n  OR \"DisableBehaviorMonitoring\"\nDetails: \"DWORD (0x00000001)\"\n\n# MDE KQL:\nDeviceRegistryEvents\n| where RegistryValueName in (\"DisableAntiSpyware\", \"DisableRealtimeMonitoring\")\n| where RegistryValueData == \"1\"\n| project Timestamp, DeviceName, RegistryKey, InitiatingProcessFileName\n```\n\n### Step 4: Detect Masquerading (T1036)\n\n```\n# Sysmon Event ID 1 - Process with legitimate name from unusual path\nEventID: 1\nImage contains: \"svchost.exe\" AND Image NOT starts with: \"C:\\Windows\\System32\\\"\nImage contains: \"csrss.exe\" AND Image NOT starts with: \"C:\\Windows\\System32\\\"\nImage contains: \"lsass.exe\" AND Image NOT starts with: \"C:\\Windows\\System32\\\"\n\n# Process name mismatch (original filename vs. current name)\n# Sysmon captures OriginalFileName from PE header\nEventID: 1\nOriginalFileName != (parsed filename from Image path)\n\n# Double extension files\nEventID: 11 (FileCreate)\nTargetFilename matches: \"*\\.pdf\\.exe\" OR \"*\\.doc\\.exe\" OR \"*\\.jpg\\.exe\"\n\n# Splunk:\nindex=sysmon EventCode=1\n| eval process_name=mvindex(split(Image,\"\\\\\"),-1)\n| where (process_name=\"svchost.exe\" AND NOT match(Image,\"(?i)C:\\\\\\\\Windows\\\\\\\\System32\"))\n  OR (process_name=\"csrss.exe\" AND NOT match(Image,\"(?i)C:\\\\\\\\Windows\\\\\\\\System32\"))\n| table _time host Image ParentImage CommandLine User\n```\n\n### Step 5: Detect LOLBin Abuse (T1218, T1127)\n\n```\n# Common LOLBin abuse patterns:\n\n# mshta.exe executing remote content\nEventID: 1\nImage ends with: \"mshta.exe\"\nCommandLine contains: \"http\" OR \"javascript:\" OR \"vbscript:\"\n\n# certutil.exe downloading files\nEventID: 1\nImage ends with: \"certutil.exe\"\nCommandLine contains: \"-urlcache\" OR \"-decode\" OR \"-encode\"\n\n# regsvr32.exe executing scriptlets\nEventID: 1\nImage ends with: \"regsvr32.exe\"\nCommandLine contains: \"\u002Fs \u002Fn \u002Fu \u002Fi:\" OR \"scrobj.dll\"\n\n# rundll32.exe with unusual DLLs\nEventID: 1\nImage ends with: \"rundll32.exe\"\nCommandLine contains: \"javascript:\" OR \".js\" OR \"http:\"\n\n# MSBuild executing inline tasks\nEventID: 1\nImage contains: \"MSBuild.exe\"\nCommandLine NOT contains: \".sln\" AND NOT contains: \".csproj\"\n```\n\n### Step 6: Build Detection Rule Correlation\n\n```\n# Combine multiple weak signals into high-confidence detection:\n\n# Rule: Potential post-exploitation evasion chain\n# Trigger when 3+ evasion techniques observed on same host within 1 hour\n\n# Splunk correlation search:\nindex=sysmon host=*\n| eval technique=case(\n    EventCode=2, \"timestomping\",\n    EventCode=8 AND NOT match(SourceImage,\"csrss|svchost\"), \"process_injection\",\n    EventCode=1 AND match(CommandLine,\"(?i)wevtutil.*cl\"), \"log_clearing\",\n    EventCode=13 AND match(TargetObject,\"DisableRealtimeMonitoring\"), \"security_disable\",\n    EventCode=1 AND match(CommandLine,\"(?i)(mshta|certutil.*urlcache|regsvr32.*\u002Fs.*\u002Fn)\"), \"lolbin_abuse\",\n    true(), NULL\n)\n| where isnotnull(technique)\n| bin _time span=1h\n| stats dc(technique) as technique_count values(technique) as techniques by host _time\n| where technique_count >= 3\n| sort - technique_count\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **Defense Evasion (TA0005)** | MITRE ATT&CK tactic where adversaries attempt to avoid detection during operations |\n| **Process Injection (T1055)** | Technique of injecting code into another process's memory space to execute in a trusted context |\n| **Timestomping (T1070.006)** | Modifying file timestamps to make malicious files appear old and blend with legitimate files |\n| **Masquerading (T1036)** | Naming malicious files or processes to match legitimate system files to avoid detection |\n| **LOLBin** | Living Off the Land Binary; legitimate Windows tool repurposed by adversaries |\n| **Indicator Removal (T1070)** | Clearing logs, deleting files, or modifying artifacts to remove evidence of compromise |\n\n## Tools & Systems\n\n- **Sysmon**: Advanced Windows system monitoring with kernel-level visibility\n- **Microsoft Defender for Endpoint**: EDR with advanced hunting (KQL) for evasion detection\n- **CrowdStrike Falcon**: IOA-based behavioral detection for evasion techniques\n- **Elastic Security**: SIEM with prebuilt detection rules for ATT&CK evasion techniques\n- **Sigma Rules**: Vendor-agnostic detection rule format with extensive evasion rule library\n\n## Common Pitfalls\n\n- **Alert fatigue from process injection rules**: Many legitimate tools (AV, accessibility) perform process injection. Maintain an allowlist of known-good source processes.\n- **Missing Sysmon Event ID 8\u002F10**: Default Sysmon configurations may not capture CreateRemoteThread or ProcessAccess. Use a comprehensive Sysmon config.\n- **Ignoring parent process context**: A suspicious command line from cmd.exe is concerning only if the parent of cmd.exe is unusual (e.g., Excel spawning cmd.exe).\n- **Not correlating across event types**: Single events are often benign. Combine multiple weak signals (process creation + network connection + file creation) for high-confidence detections.\n",{"name":5,"tags":25,"author":32,"domain":33,"source":34,"license":15,"version":35,"nist_csf":36,"subdomain":41,"description":42,"mitre_attack":43,"source_commit":49,"d3fend_techniques":50},[26,27,28,29,30,31],"endpoint","edr","threat-hunting","defense-evasion","MITRE-ATT&CK","detection-engineering","mahipal","cybersecurity","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","1.0.0",[37,38,39,40],"PR.PS-01","PR.PS-02","DE.CM-01","PR.IR-01","endpoint-security","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.\n",[44,45,46,47,48],"T1055","T1547","T1059","T1036","T1027","04450304b12645cb2b974ab96d28c0664758a88d",[51,52,53,54,55],"File Metadata Consistency Validation","Content Format Conversion","File Content Analysis","Platform Hardening","File Format Verification","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs",1,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-11 23:56:26",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill detecting-evasion-techniques-in-endpoint-logs",{"tool":72,"command":73},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill detecting-evasion-techniques-in-endpoint-logs",{"tool":75,"command":76},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill detecting-evasion-techniques-in-endpoint-logs","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",true,[80,86,90,96,100,104,110],{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"assets\u002Ftemplate.md","ASSET","资产文件",833,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002Fassets\u002Ftemplate.md",{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":91,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fapi-reference.md","REFERENCE","参考文档",1713,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002Freferences\u002Fapi-reference.md",{"path":97,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fstandards.md",1635,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002Freferences\u002Fstandards.md",{"path":101,"resourceType":92,"resourceTypeDesc":93,"sizeBytes":102,"sourceHtmlUrl":103},"references\u002Fworkflows.md",2246,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002Freferences\u002Fworkflows.md",{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"scripts\u002Fagent.py","SCRIPT","脚本",6092,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002Fscripts\u002Fagent.py",{"path":111,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":112,"sourceHtmlUrl":113},"scripts\u002Fprocess.py",7300,"https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002Fscripts\u002Fprocess.py",[115,123,130,138,146,152],{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":119,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":20},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":20},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":134,"sourceHtmlUrl":135,"categories":136,"keywords":137,"publishedAt":20},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":142,"sourceHtmlUrl":143,"categories":144,"keywords":145,"publishedAt":20},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":147,"name":148,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":20},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[],{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":156,"sourceHtmlUrl":157,"categories":158,"keywords":159,"publishedAt":20},"01M73E70A4EVRR8Y7JCX6MDV0W","performing-active-directory-forest-trust-attack","Enumerate and audit Active Directory forest trust relationships using impacket for SID filtering analysis, trust key extraction, cross-forest SID history abuse detection, and inter-realm Kerberos ticket assessment.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-active-directory-forest-trust-attack\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fperforming-active-directory-forest-trust-attack\u002FSKILL.md",[],[]]