Detecção de Técnicas de Evasão em Logs de Endpoint

Quando Usar

Use esta habilidade quando:

• Estiver procurando por técnicas de evasão de defesa de adversários (MITRE ATT&CK TA0005) em telemetria de endpoint
• Estiver construindo regras de detecção para métodos comuns de evasão (injeção de processos, timestomping, limpeza de logs)
• Estiver investigando incidentes onde adversários desabilitaram ou contornaram ferramentas de segurança
• Estiver analisando logs de endpoint para indicadores de abuso de binários "living-off-the-land" (LOLBin)

Não use esta habilidade para evasão em nível de rede (use análise de tráfego de rede) ou para engenharia reversa de malware.

Pré-requisitos

• Sysmon instalado e configurado com regras de log abrangentes (configuração SwiftOnSecurity ou Olaf Hartong)
• Log de Eventos de Segurança do Windows com política de auditoria avançada habilitada
• Telemetria EDR (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint)
• Plataforma SIEM para correlação de logs (Splunk, Elastic, Sentinel)
• Matriz MITRE ATT&CK Enterprise para referência de técnicas

Fluxo de Trabalho

Etapa 1: Detectar Manipulação de Logs (T1070)

Limpeza do Log de Eventos do Windows (T1070.001):

# Sysmon Event ID 1 (Process Create) for wevtutil
EventID: 1
CommandLine contains: "wevtutil cl" OR "wevtutil clear-log"

# Security Event ID 1102 - Audit log was cleared
EventID: 1102
Source: Microsoft-Windows-Eventlog

# System Event ID 104 - Event log was cleared
EventID: 104

# PowerShell log clearing
EventID: 1 (Sysmon)
CommandLine contains: "Clear-EventLog" OR "Remove-EventLog"

# Splunk query:
index=windows (EventCode=1102 OR EventCode=104)
  OR (EventCode=1 CommandLine="*wevtutil*cl*")
  OR (EventCode=1 CommandLine="*Clear-EventLog*")
| table _time host user CommandLine EventCode

Timestomping (T1070.006):

# Sysmon Event ID 2 - File creation time changed
EventID: 2
# Look for creation times set far in the past on recently-written files
# Correlate with Event ID 11 (FileCreate) - if FileCreate is recent but
# creation time in Event ID 2 is old, timestomping is likely

# MDE Advanced Hunting (KQL):
DeviceFileEvents
| where ActionType == "FileTimestampModified"
| where Timestamp > ago(7d)
| extend TimeDiff = datetime_diff('day', Timestamp, ReportedFileCreationTime)
| where TimeDiff > 30
| project Timestamp, DeviceName, FileName, FolderPath,
    ReportedFileCreationTime, InitiatingProcessFileName

Etapa 2: Detectar Injeção de Processos (T1055)

# Sysmon Event ID 8 - CreateRemoteThread
EventID: 8
# Alert when source process is unusual (not system processes)
# Filter out known legitimate: antivirus, debugging tools
SourceImage NOT IN ("C:\Windows\System32\csrss.exe",
                     "C:\Windows\System32\lsass.exe")

# Sysmon Event ID 10 - ProcessAccess with suspicious access masks
EventID: 10
GrantedAccess contains: "0x1F0FFF" OR "0x1FFFFF" OR "0x001F0FFF"
# PROCESS_ALL_ACCESS = 0x1F0FFF (common in injection)
# Filter legitimate: AV accessing all processes

# Sysmon Event ID 25 - Process Tampering
EventID: 25
Type: "Image is replaced"  # Process hollowing indicator

# Splunk detection:
index=sysmon EventCode=8
| where NOT match(SourceImage, "(?i)(csrss|svchost|MsMpEng|defender)")
| stats count by SourceImage TargetImage host
| where count < 5
| sort - count

Etapa 3: Detectar Desabilitação de Ferramentas de Segurança (T1562)

# Service stopped events for security services
EventID: 7045 (new service) OR 7036 (service state change)
ServiceName IN ("WinDefend", "Sense", "CrowdStrike Falcon Sensor",
                 "SentinelAgent", "csagent", "MBAMService")

# Sysmon Event ID 1 - Processes that disable Defender
CommandLine contains: "Set-MpPreference -DisableRealtimeMonitoring"
  OR "sc stop WinDefend"
  OR "sc config WinDefend start= disabled"
  OR "net stop" AND ("windefend" OR "sense" OR "csagent")

# Registry modification to disable security features
# Sysmon Event ID 13 - Registry value set
TargetObject contains: "DisableAntiSpyware"
  OR "DisableRealtimeMonitoring"
  OR "DisableBehaviorMonitoring"
Details: "DWORD (0x00000001)"

# MDE KQL:
DeviceRegistryEvents
| where RegistryValueName in ("DisableAntiSpyware", "DisableRealtimeMonitoring")
| where RegistryValueData == "1"
| project Timestamp, DeviceName, RegistryKey, InitiatingProcessFileName

Etapa 4: Detectar Mascaramento (T1036)

# Sysmon Event ID 1 - Processo com nome legítimo de caminho incomum
EventID: 1
Image contém: "svchost.exe" E Image NÃO começa com: "C:\Windows\System32\"
Image contém: "csrss.exe" E Image NÃO começa com: "C:\Windows\System32\"

…