Search Evasion Techniques

Names, Techniques, Definitions, Keywords

Technique Name	Technique ID's	Snippet(s)	Rules(s)	OS
XProtect Encryption Abuse	U0711
kernel flag inspection via sysctl	U0135
Exfiltration via SMTP	U0912
XBEL Recently Opened Files Check	U1352
Default Windows Wallpaper Check	U1351

XProtect Encryption Abuse	Python
kernel flag inspection via sysctl	Python
Exfiltration via SMTP	C#
XBEL Recently Opened Files Check	Python
Virtualization/Sandbox Evasion: User Activity Based Checks	Python

YARA_XprotectDecryption	YARA
YARA_SMTP_Exfiltration	YARA
Detect Disassembly Obfuscation Rogue Byte	YARA
VBAPurging	YARA
YARA_Detect_WindowsDefender_AVEmulator	YARA