How do you detect defense evasion?

Detect defense evasion by alerting on the act of blinding defenders: security event-log clearing (Event 1102, or wevtutil cl), EDR/AV sensor stop, uninstall or telemetry loss, AMSI/ETW bypass strings in PowerShell script-block logs (4104), heavily encoded or compressed command lines, and timestomping of dropped binaries. These are high-fidelity because disabling telemetry is rarely legitimate — and EDR tamper often precedes ransomware via BYOVD. Forward logs off-host so clearing cannot erase them. SigmaHQ and MITRE CAR provide vetted rules.

Detecting Defense Evasion: Log Clearing, AMSI Bypass and EDR Tampering

Attackers blind defenders: clearing event logs, bypassing AMSI and ETW, tampering with EDR, obfuscating scripts and timestomping. This pack covers detecting the evasion itself — often a high-fidelity signal, because disabling telemetry is rarely legitimate. It complements living-off-the-land and BYOVD coverage.

Signals at a Glance

Evasion	Signal	ATT&CK
Event-log clearing	Event 1102 (security log cleared); 104 (other logs)	T1070.001
EDR/AV tamper	Sensor service stop/uninstall; telemetry loss; BYOVD kill	T1562.001
AMSI/ETW bypass	Script-block content with known bypass strings; patched ntdll	T1562.001
Obfuscation	Encoded/compressed PowerShell; high-entropy command lines	T1027
Timestomping	File MACE times set to implausible/matching values	T1070.006

Turning Off the Lights

The brightest signal is the destruction of telemetry. Alert critically on security-log clearing and on EDR-sensor stop/uninstall — these should essentially never happen interactively:

title: Security Event Log Cleared or Telemetry Tampered
logsource:
    product: windows
    service: security
detection:
    cleared:
        EventID: 1102            # audit log was cleared
    wevtutil:
        CommandLine|contains|all: ['wevtutil','cl']   # clear-log
    condition: cleared or wevtutil
level: critical

AMSI, Obfuscation & Timestomp

With PowerShell script-block logging (4104), alert on known AMSI-bypass strings and on heavily encoded/compressed scripts; watch for ETW-patching and in-memory tampering indicators from your EDR.
Treat EDR-sensor stop, uninstall or sudden telemetry loss as high severity — often achieved via BYOVD immediately before ransomware.
Hunt for timestomping (file MACE times set to implausible or uniformly matching values) on dropped binaries.

Vetted sources

SigmaHQ covers log clearing, AMSI-bypass strings, EDR-tamper and timestomping; MITRE CAR has defense-evasion analytics. Protect logs by forwarding them off-host so clearing does not erase the evidence.

Detect Attempts to Blind You

Mjolnir Security helps organisations detect log clearing, EDR tampering and evasion.

Detection EngineeringManaged Detection & ResponseThreat HuntingEndpoint HardeningIncident Response

Detection Engineering Building log-clearing and EDR-tamper detections.
Managed Detection and Response Monitoring for telemetry loss and evasion.
24/7 Incident Response Containment when evasion is detected. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026