Defence evasion is the largest category in the library (88 rules), and tampering adds 37 more, with six file-type-obfuscation rules on top. Together that is about 130 rules, and nearly a third of ATT&CK tag counts point at the Defense Evasion tactic. This post walks through every behaviour group in them. Most are informational: they tell you an attacker is preparing, not that data has been stolen yet.
1. Switching off security tools
Windows Defender disabled via the registry (two rules) informational
a new exclusion added to Defender low
Defender configuration manipulated low
a process attempts to terminate endpoint security software medium
System-integrity hunt: Security-related services halted informational
the EDR agent's own management tool used suspiciously informational
fltmc used to unload a filter driver informational
a commonly abused host process tries to kill a process informational
The management-tool rule deserves a note: Cortex XDR ships a command-line tool, cytool.exe, that can disable the agent. The rule fires when it runs from anything not signed by Palo Alto Networks (the installer's own custom action is excluded), because attackers use the vendor's own switch to turn the vendor's sensor off.
Why attackers do this: unloading a filter driver or killing the agent removes the sensor itself. The rules look for the attempt, which is important because a successful kill may leave no further events.
2. Weakening the operating system's protections
- UAC: tampering with the User Account Control configuration (medium).
- SmartScreen disabled via the registry.
- Windows Firewall: disabled via the registry (low, two rules), firewall policy edited via the registry, and
netshmodifying the allowed port or program lists. - System policy: a process making changes to the Windows system policy, plus tampering with the Control Panel configuration.
- Task Manager and Registry Editor disabled via the registry. Malware does this to stop a user from killing it.
- Windows File Protection disabled via the registry (low).
- System Restore configuration tampered with (low), and volume shadow copy configuration manipulated (see the impact section below).
- Test Mode / unsigned drivers permitted (medium), developer mode enabled, and the safe boot configuration manipulated (medium).
- Internet Explorer / Office: protected mode and security settings modified, Defense-evasion hunt: ActiveX alert altering, and Outlook security disabled through the registry (two rules).
- Browsers: Defense-evasion hunt: Private browsing session initiated in Chrome (informational), and Chrome run with key security features disabled (low).
3. Blinding the logs
PowerShell logging disabled via the registry (two rules)
the System-integrity hunt: Registry change turns off the event-log service
event log auto-backup configuration manipulated
permissions on the Application event log changed
the Defense-evasion hunt: Audit records removed from the Windows Security log informational
event logs cleared using wmic.exe medium
event logs cleared using PowerShell medium
log deletion in known log directories (two rules) and via command-line tools
Volume USN journal deleted with fsutil medium
a tracing tool used
packet capture with tshark or tcpdump
Clearing the Security log is one of the most dependable signals in the whole library, because legitimate administrators almost never do it, and never from a script.
4. Disguising files and processes (masquerading)
an unsigned process using a Windows system process name (two rules)
common Oracle, Mozilla and Apple process names lacking the vendor signature (3 rules, informational)
an executable moved into a Windows system folder (two rules, medium)
an unsigned process running from the Windows root folder
Defense-evasion hunt: Untrusted program executing from temporary storage
a process running from the recycle bin low
Defense-evasion hunt: Program file saved in temporary storage (the noisiest rule in the library)
Defense-evasion hunt: Driver artifact stored in temporary storage
a suspicious executable created in the .NET directory HIGH
hidden files and directories created
Defense-evasion hunt: Hidden-account property assigned to a user
registry change that hides known file extensions
double-extension binaries created or run medium (two rules)
base64 decoding with the system utility
System-integrity hunt: Shell executable relocated to a second path
file timestamps tampered with
The common thread is a mismatch: what the file claims to be versus where it lives, who signed it and how it got there. The .NET directory rule is high severity because malware likes to hide inside a trusted framework folder.
5. Alternate data streams
Three rules: a scripting engine creating a stream, an unsigned process creating a stream, and a scripting engine executing code from a stream. Streams hide content from directory listings, and the third rule catches the moment it is used.
6. Process injection and proxy execution
Defense-evasion hunt: Code hosted inside ping.exe informational
Defense-evasion hunt: Rundll32.exe executing injected code low
an Office process or a scripting engine injecting code medium
an unsigned process injecting code into another process
DLL side-loading using Xwizard low
rundll32 launching an executable using ordinal arguments medium
Defense-evasion hunt: Known-abused program launches with obfuscated text
command running with COMSPEC in the argument low
Defense-evasion hunt: Environment state changed by variable assignment
ping executed against the loopback address (used as a sleep)
Process injection puts the attacker's code in a process an analyst trusts. Notice that the targets are small utilities (ping, rundll32), chosen because nobody notices them using memory.
7. Compilers and build tools
Compilers started by Office, by a commonly abused shell process, or by a suspicious .NET process (several rules) catch payloads built on the target. Defense-evasion hunt: MSBuild process launch is informational, and a "Defense-evasion hunt: Potential malicious .NET compilation started by a commonly abused process behavior" rule is medium.
8. Certificates and trust
Defense-evasion hunt: Root certificates imported with trust-store utilities (two rules)
Defense-evasion hunt: Trusted-root store receives a certificate
tampering with the Windows certificate blocking configuration
the certificate management tool (certutil) used with a suspicious command line medium
Defense-evasion hunt: Certutil process launch informational
manipulation of the cryptographic Subject Interface Package provider
The SIP rule is subtle: tampering with signature validation lets an attacker make unsigned code appear signed.
9. AMSI, Kerberos tooling and network evasion
- AMSI: Defense-evasion hunt: Unusual AMSI DLL load location behavior, and a direct Remote-movement hunt: AMSI scanning evasion behavior (the latter filed under lateral movement).
- Kerberos tooling: Rubeus impersonation (medium) and Kerberos ticket forging with Impacket's ticketer (medium).
- Network tools: Netcat connections (high), possible dnscat2 command and control (high), and a possible connection to a TOR relay (medium). These appear again in post 5.
- Downloads: a non-browser process downloading from GitHub, MSI accessing a web page that runs a server-side script (two rules, medium), an unsigned process spawning a browser, and Defense-evasion hunt: Procdump launched from an uncommon folder (medium).
10. Tampering that destroys recovery
The tampering category adds the actions that matter most in ransomware cases.
process requests deletion of Windows shadow copies HIGH
System-integrity hunt: Quiet wbadmin activity removes backup or recovery data HIGH
boot configuration modified with bcdedit (two rules)
manipulation of the volume shadow copy configuration
Windows DNS configuration changed through wmic low
encoded information using the certificate management tool medium
System-integrity hunt: System shutdown initiated through a command
the Windows logon text changed medium
Shadow-copy and backup-catalogue deletion are the two highest-severity rules in this group, and they are among the best ransomware tripwires you can have.
Interpreting the group
- Informational does not mean ignore. Three or four of these on one host in an hour is an incident.
- Disable switches matter most. Anything that turns off logging or antivirus should outrank the thing it was hiding.
- Test the quiet rules. Log clearing, exclusion changes and shadow-copy deletion rarely fire in a healthy network, so you must replay them in a lab to know they still work.
- Expect installers to trigger the loud ones. Root certificates, firewall edits and temp-folder executables belong in a scoring model, not a pager.
Deep dive A: what disabling Defender really looks like
Windows Defender can be switched off in several ways, and the rules cover the main ones. The registry values that control real-time protection and anti-spyware, and the folder lists that hold exclusions, are the targets. Exclusions are the stealthier choice: the tool stays "on" but ignores a path, so a malware drop folder goes unscanned.
turn protection off registry values for real-time monitoring / anti-spyware set to disabled
add an exclusion a path, extension or process added to the exclusion lists
change the cloud settings submission and reporting reduced so nothing is sent for analysis
Defender's own event log records configuration changes and protection being disabled, so correlate the EDR rule with those events. Turn on tamper protection wherever it is available; it blocks most of these writes outright, and a rule that still fires means something tried and failed.
Deep dive B: log clearing and what survives
Clearing the Security log produces its own event (the "audit log was cleared" record) and clearing the System log does the same, so clearing is self-announcing unless the attacker also kills the log service. That is why the library has separate rules for the service being disabled, for auto-backup being changed, for the log's permissions being altered and for clearing by wevtutil, wmic and PowerShell.
if a host's security log suddenly has a gap or starts at a recent time, treat it as tampering
forward logs to a collector; an attacker on the host cannot clear the copy
alert on the "log cleared" events from the central store, not only from the host
Deep dive C: process injection, plainly
Injection means running attacker code inside another process's memory. The common patterns differ in how the code arrives.
classic write the code into the target, then start a thread in it
hollowing start a trusted program suspended, replace its code, resume it
reflective load a library from memory without touching disk
side-loading place a malicious library where a trusted program will load it first (the Xwizard rule)
The telemetry that matters is cross-process activity: a process writing into another process's memory or creating a remote thread. The library's rules combine that with the victim: small, unremarkable utilities such as ping.exe and rundll32.exe, or a process like notepad.exe that should never make a network connection (see post 5).
Deep dive D: validating masquerading properly
A name check is not enough. A reliable test compares four facts.
expected path system programs live in system folders
expected signer the vendor named in the file
expected parent for example, only the service manager starts a service host
expected prevalence a rarely seen file with a system name is suspicious
Keep a table of well-known system process names and their legitimate path, signer and parent; a mismatch on any column is a lead. The vendor-name rules for Oracle, Mozilla and Apple apply the same logic to third-party software.
Deep dive E: the ransomware pre-flight
The tampering rules together describe what most ransomware does in the last minutes before encryption.
1 stop security services and backup agents
2 delete shadow copies and backup catalogues (HIGH)
3 change boot settings so repair tools are unavailable
4 disable the event log service or clear logs
5 encrypt files; show the note; change logon text
If you automate only one response, make it this one: when shadow-copy or backup-catalogue deletion fires on a non-server host, isolate the machine immediately. It is both the clearest warning and the last point where isolation can still save most of the data.