Log Analysis and Log Evasion
Core Principles: The best anti-logging strategy is not to generate logs, rather than deleting them afterward
⛔ In-Depth References
Part A: Blue Team Perspective — Key Log Detection Points
Key Windows Event IDs
| Event ID |
Log Source |
Meaning |
Red Team Action Trigger |
| 4624 |
Security |
Successful Logon |
PTH/PTT/RDP |
| 4625 |
Security |
Failed Logon |
Password Spraying |
| 4648 |
Security |
Explicit Credential Logon |
runas/PsExec |
| 4672 |
Security |
Special Privileges Assigned |
Privilege Escalation |
| 4688 |
Security |
New Process Created |
Tool Execution |
| 4698 |
Security |
Scheduled Task Created |
Persistence |
| 4720 |
Security |
User Created |
Backdoor Account |
| 5140 |
Security |
Network Share Access |
Lateral Movement |
| 5156 |
Security |
Network Connection |
C2 Communication |
| 7045 |
System |
Service Installed |
Persistence/PsExec |
| 1102 |
Security |
Log Clearing |
⛔ Anti-forensics exposure! |
| 4104 |
PowerShell |
Script Block Logging |
PS Attack Tools |
| 4103 |
PowerShell |
Module Logging |
PS Command Execution |
| 1 |
Sysmon |
Process Creation (with hash) |
All Tool Execution |
| 3 |
Sysmon |
Network Connection |
C2 Communication |
| 8 |
Sysmon |
CreateRemoteThread |
Process Injection |
| 10 |
Sysmon |
Process Access |
LSASS dump |
| 11 |
Sysmon |
File Creation |
Tool Dropped to Disk |
Key Linux Logs
| Log |
Location |
Recorded Content |
| auth.log/secure |
/var/log/ |
SSH login, sudo, su |
| wtmp |
/var/log/ |
Login/logout records |
| btmp |
/var/log/ |
Failed logins |
| lastlog |
/var/log/ |
Last login time |
| audit.log |
/var/log/audit/ |
auditd rule matches |
| syslog/messages |
/var/log/ |
System events |
| journal |
/var/log/journal/ |
systemd logs |
| .bash_history |
~/ |
Command history |
Common SIEM Detection Rules (that need to be bypassed)
Sigma 规则示例（蓝队部署）：
├─ 进程注入: Sysmon EventID 8 (CreateRemoteThread to lsass)
├─ 凭据 Dump: EventID 10 (OpenProcess to lsass)
├─ 横向移动: EventID 4648 + 4624 LogonType 3
├─ 持久化: EventID 7045 (新服务) / 4698 (新计划任务)
├─ 日志清除: EventID 1102 / 104 → 高优先级告警！
└─ PowerShell: EventID 4104 含 "IEX" / "Invoke-" / "-enc"
Part B: Red Team Perspective — Log Evasion
Strategy 1: Prevent log generation (optimal)
Windows:
├─ 禁用 ETW Provider → 阻止 PowerShell/AMS 日志
│ patch ntdll!EtwEventWrite → ret
│ 或 NtTraceEvent hook
├─ 关闭 ScriptBlock Logging
│ reg: HKLM\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging → 0
├─ 使用 .NET 避免 PowerShell 日志
│ C# 直接调用 .NET → 不走 PS 引擎 → 无 4104
├─ Thread detach from ETW
│ patch 当前线程的 ETW context → 不再产生事件
└─ Sysmon 绕过
unload sysmon driver / patch 事件回调
Linux:
├─ 操作前: unset HISTFILE; export HISTSIZE=0; export HISTFILESIZE=0
├─ 或: set +o history
├─ 使用空格前缀命令（bash HISTCONTROL=ignorespace）
├─ kill -9 auditd（需 root，会产生停止日志）
└─ auditctl -e 0（关闭审计，更隐蔽）
Strategy 2: Bypass logging (without triggering detection rules)
绕过 Sysmon:
├─ 进程注入: 避免 CreateRemoteThread → 用 APC/Callback/Early Bird
├─ LSASS 访问: 避免直接 OpenProcess → 用 Handle 复制/MiniDump
├─ 网络: 使用 raw socket → Sysmon EID 3 可能不捕获
└─ 文件: 使用已存在文件名/路径 → 不触发新文件规则
绕过 PowerShell 日志:
├─ 降级攻击: powershell -version 2（无 ScriptBlock 日志）
├─ 使用 C#/.NET: 直接反射调用 → 无 PS 日志
├─ AMSI bypass → 阻止脚本内容被记录
└─ 使用 WMI/COM → 不走 PowerShell 引擎
绕过 4688 进程创建:
├─ 进程名伪装: 复制合法程序名执行
├─ 使用 LOLBins: rundll32/mshta/certutil → 合法进程
├─ 父进程欺骗: 设置 PPID 为正常进程
└─ 命令行混淆: 环境变量展开、特殊字符
Strategy 3: Precise clearing (remediation when logs have already been generated)
⛔ NEVER 清空整个日志 → EventID 1102 会立即告警！
⛔ ALWAYS 精准删除特定条目
Windows 精准清除:
├─ 方式 1: 停止 EventLog 服务 → 修改 .evtx 文件 → 重启服务
│ net stop eventlog（需 SYSTEM）
│ 修改 evtx 二进制结构删除特定记录
│ net start eventlog
├─ 方式 2: Danderspritz eventlogedit（NSA 工具）
│ 精准删除指定 EventID 的记录，修复文件校验
├─ 方式 3: Invoke-Phant0m
│ 杀掉 EventLog 服务的所有线程 → 服务在但不写日志
└─ 方式 4: MiniNT 注册表键
HKLM\SYSTEM\CurrentControlSet\Control\MiniNT → 阻止日志写入
Linux 精准清除:
├─ auth.log: sed -i '/特定IP/d' /var/log/auth.log
├─ wtmp: utmpdump /var/log/wtmp > tmp.txt
│ 编辑删除特定行
│ utmpdump -r < tmp.txt > /var/log/wtmp
├─ lastlog: 工具修改特定用户的 lastlog 记录
├─ audit.log: aureport 确认记录 → sed 删除
└─ journal: journalctl --vacuum-time=1s（⛔ 会清全部）
Strategy 4: Real-time log forwarding countermeasures
现代企业会实时转发日志到 SIEM → 本地删除无效！
应对方案：
├─ 从一开始就不产生日志（策略 1）→ 最优
├─ 绕过 Sysmon/ETW（策略 2）→ 不产生特定事件
├─ 使用 SSH 隧道/DNS 隧道 → 网络日志中混入合法流量
├─ 操作时间选择 → 凌晨/节假日 → SOC 响应慢
└─ 理解 SIEM 规则阈值 → 低于告警阈值操作
例：密码喷洒锁定阈值 5次 → 每用户只尝试 2 次
Comparison Table
| Blue Team Monitoring |
Trigger Condition |
Red Team Countermeasure |
| EventID 4624 |
Any login |
Normal hours + legitimate username |
| EventID 4688 |
New process |
LOLBins / PPID spoofing |
| EventID 4104 |
PS script |
.NET / AMSI bypass / PS v2 |
| Sysmon EID 1 |
Process+hash |
Modify known whitelisted program |
| Sysmon EID 8 |
Remote thread |
APC / Timer callback |
| Sysmon EID 10 |
Process access |
Handle duplicate |
| auditd |
syscall auditing |
Disable auditd / direct syscall |
| Network logs |
Connection records |
Domain fronting / CDN / legitimate services |
