Search Evasion Techniques

Names, Techniques, Definitions, Keywords

Technique Name	Technique ID's	Snippet(s)	Rules(s)	OS
Removing Commands from SELinux Audit Logs	U0312
Deleting Troubleshoot Information and Core Dumps	U0311
Manipulating Debug Logs	U0310
Clearing Kernel Message	U0309
XProtect Encryption Abuse	U0711

Removing Commands from SELinux Audit Logs	bash
Deleting Troubleshoot Information and Core Dumps	bash
Manipulating Debug Logs	bash
XProtect Encryption Abuse	Python
kernel flag inspection via sysctl	Python

YARA_XprotectDecryption	YARA
YARA_SMTP_Exfiltration	YARA
Detect Disassembly Obfuscation Rogue Byte	YARA
VBAPurging	YARA
YARA_Detect_WindowsDefender_AVEmulator	YARA