detecting-evasion-techniques-in-endpoint-logs

Overview of detecting-evasion-techniques-in-endpoint-logs skill

What this skill does

The detecting-evasion-techniques-in-endpoint-logs skill helps you hunt for defense evasion in Windows endpoint telemetry, especially MITRE ATT&CK TA0005 activity like log clearing, timestomping, process injection, and disabling security tools. It is most useful for analysts who need a practical detection workflow, not just a list of suspicious commands.

Who should install it

Use the detecting-evasion-techniques-in-endpoint-logs skill if you do threat hunting, detection engineering, or incident triage on Sysmon, Windows Security, or EDR logs. It fits best when you already have endpoint event data and want to turn a vague suspicion into a repeatable hunt.

What makes it different

This skill is grounded in concrete event IDs, query patterns, and hunt templates rather than generic advice. The repo includes workflow guidance, a detection template, and script-based examples, which makes the detecting-evasion-techniques-in-endpoint-logs skill more actionable than a plain prompt for “find malicious activity.”

How to Use detecting-evasion-techniques-in-endpoint-logs skill

Install and confirm scope

Install with npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-evasion-techniques-in-endpoint-logs. After install, confirm the skill activates for endpoint defense-evasion requests, not network evasion or malware reversing. If your case is about proxying, traffic shaping, or payload unpacking, this skill is the wrong fit.

Start with the right inputs

For strong detecting-evasion-techniques-in-endpoint-logs usage, provide:

• log source: Sysmon, Windows Security, or EDR
• target technique: for example T1070.001, T1055, or T1562.001
• time window: last 24 hours vs. 30–90 days
• environment constraints: domain, baseline noise, allowlists, known admin tools

Weak input: “find evasion.”
Better input: “Hunt for T1070.001 log clearing in Sysmon and Security logs across the last 14 days on 200 endpoints; prioritize evidence that distinguishes admin maintenance from attacker cleanup.”

Read these files first

For the fastest detecting-evasion-techniques-in-endpoint-logs guide, read:

1. SKILL.md for scope and triggers
2. assets/template.md for the hunt output format
3. references/api-reference.md for event IDs and detection patterns
4. references/workflows.md for hunt and deployment flow
5. references/standards.md for ATT&CK and Sigma context

Use a hunt-first workflow

The most reliable detecting-evasion-techniques-in-endpoint-logs usage is: pick one technique, validate log coverage, run a narrow query, then triage. Start with the hunt template, map the technique to the right event source, and only then expand to adjacent telemetry like process trees or registry changes. This keeps false positives manageable and makes the result easier to operationalize.

detecting-evasion-techniques-in-endpoint-logs skill FAQ

Is this mainly for Threat Hunting?

Yes. detecting-evasion-techniques-in-endpoint-logs for Threat Hunting is the clearest use case because the skill is built around hypothesis-driven searches, triage, and rule refinement. It also works for detection engineering when you want to convert hunt findings into a reusable SIEM rule.

Can I use it with a generic prompt instead?

You can, but the skill is better when you want less guesswork. A generic prompt may produce broad advice; this skill gives you technique-specific inputs, event-source hints, and a practical workflow that is easier to reuse across investigations.

What are the boundaries?

It is focused on endpoint telemetry and Windows-centric defense evasion. Do not expect it to solve network-layer evasion, memory forensics, or full malware analysis. If your logs do not include process creation, script execution, or file-time changes, the detection value will be limited.

Is it beginner-friendly?

Yes, if you already know basic endpoint logging terms. Beginners get the most value by starting with one technique, one data source, and one time range instead of trying to hunt all evasion methods at once.

How to Improve detecting-evasion-techniques-in-endpoint-logs

Give the skill sharper hunt context

The biggest quality gain comes from specifying the technique, platform, and expected noise. For example, mention wevtutil cl, Clear-EventLog, Sysmon Event ID 2, or Defender-disable commands when relevant. That helps the detecting-evasion-techniques-in-endpoint-logs skill produce precise detection logic instead of broad hunting language.

Include baseline and exclusion details

If your environment has admin scripts, imaging tools, EDR maintenance tasks, or backup agents, say so up front. False positives often come from legitimate log maintenance or security operations, so the best detecting-evasion-techniques-in-endpoint-logs install outcome is a prompt that includes known-good behavior to exclude.

Iterate from evidence, not assumptions

After the first output, refine by feeding back the actual artifacts: event IDs, command lines, source/target images, or noisy hosts. Ask for a narrower query, a triage checklist, or a higher-signal version of the hunt. That is the fastest way to improve detecting-evasion-techniques-in-endpoint-logs usage without overexpanding scope.