<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-defense-evasion-testing
description: >-
  Test detection capabilities against defense evasion techniques including
  process injection, AMSI bypass, EDR unhooking, timestomping, indicator
  removal, and living-off-the-land binaries (LOLBins) mapped to MITRE ATT&CK.
domain: cybersecurity
subdomain: adversary-simulation
tags:
  - defense-evasion
  - process-injection
  - amsi-bypass
  - lolbins
  - edr-evasion
  - indicator-removal
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1055", "T1562.001", "T1070", "T1218", "T1027", "T1036"]
  frameworks: ["MITRE ATT&CK"]
  tools: ["python3", "atomic-red-team", "sysmon"]
---

# Implementing Defense Evasion Testing

## Overview

Defense evasion testing validates whether security controls detect adversary
techniques designed to avoid detection. This includes testing EDR coverage
against process injection, AMSI bypass, log tampering, binary masquerading,
and abuse of legitimate system utilities (LOLBins).

## Prerequisites

| Tool / Requirement | Details |
|---|---|
| `python3` | Security tooling |
| `Atomic Red Team` | Security tooling |
| `Sysmon` | Security tooling |
| `EDR agent deployed` | Security tooling |
| Test systems with full endpoint monitoring active | Environment requirement |
| Baseline of normal LOLBin usage for false positive tuning | Environment requirement |
| SIEM correlation rules for evasion techniques | Environment requirement |

## Workflow

### Step 1: Process Injection Testing (T1055)

```bash
# Test process injection detection variants
node scripts/agent.js test-evasion --technique T1055.001 --mode simulate
node scripts/agent.js test-evasion --technique T1055.003 --mode simulate
node scripts/agent.js test-evasion --technique T1055.012 --mode simulate

# Verify Sysmon Event ID 8 (CreateRemoteThread) detection
node scripts/agent.js check-detection --technique T1055 --event-source sysmon
```

### Step 2: AMSI and ETW Bypass Testing (T1562.001)

```powershell
# Test AMSI bypass detection (PowerShell)
# [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
# The above should trigger AMSI tampering detection

# Test ETW patching detection
# Patch ntdll!EtwEventWrite — should trigger EDR alert
```

```bash
node scripts/agent.js test-evasion --technique T1562.001 --variant amsi
node scripts/agent.js test-evasion --technique T1562.001 --variant etw
```

### Step 3: LOLBin Abuse Testing (T1218)

```bash
# Test common LOLBin techniques
node scripts/agent.js test-lolbin --binary "mshta" --payload "safe_test.hta"
node scripts/agent.js test-lolbin --binary "certutil" --payload "-urlcache -f http://safe.example.com/test"
node scripts/agent.js test-lolbin --binary "rundll32" --payload "safe_test.dll,EntryPoint"

# Check for LOLBin abuse detection
node scripts/agent.js check-detection --technique T1218 --event-source edr
```

### Step 4: Indicator Removal Testing (T1070)

```bash
# Test log clearing detection (T1070.001)
node scripts/agent.js test-evasion --technique T1070.001 --mode simulate

# Test timestomping detection (T1070.006)
node scripts/agent.js test-evasion --technique T1070.006 --mode simulate

# Generate defense evasion report
node scripts/agent.js report --execution-log evasion.json
```

## Detection

```yaml
title: Defense Evasion Testing Detection
id: 7c69d679-215c-4988-8a51-b074bd9fa819
status: experimental
description: Detects suspicious activity related to implementing defense evasion testing techniques in adversary simulation context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*defense*"
  condition: selection
level: high
tags:
  - attack.t1055
  - attack.t1562.001
  - attack.t1070
  - attack.t1218
  - attack.t1027
  - attack.t1036
  - attack.execution
falsepositives:
  - Authorized red team exercises during approved testing windows
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Defense Evasion Testing Detection | windows/process_creation | Sigma rule (high) |
| ATT&CK Coverage | MITRE ATT&CK | T1055, T1562.001, T1070, T1218, T1027, T1036 |

## Verification

- [ ] Process injection variants detected by EDR/Sysmon
- [ ] AMSI/ETW tampering detected and alerted
- [ ] LOLBin abuse flagged by behavioral detection
- [ ] Log clearing and timestomping detected
- [ ] False positive rates documented for each technique

## References

- [LOLBAS Project](https://lolbas-project.github.io/) — Living Off The Land Binaries catalog
- [MITRE ATT&CK Defense Evasion](https://attack.mitre.org/tactics/TA0005/) — Technique catalog
