Benchmark: TA0005 Defense Evasion
Overview
The adversary is trying to avoid being detected.
Defense Evasion consists of techniques that adversaries use to avoid detection throughout their compromise. Techniques used for defense evasion include uninstalling/disabling security software or obfuscating/encrypting data and scripts. Adversaries also leverage and abuse trusted processes to hide and masquerade their malware. Other tactics’ techniques are cross-listed here when those techniques include the added benefit of subverting defenses.
Usage
Install the mod:
mkdir dashboardscd dashboardspowerpipe mod initpowerpipe mod install github.com/turbot/tailpipe-mod-github-audit-log-detectionsStart the Powerpipe server:
powerpipe serverOpen http://localhost:9033 in your browser and select TA0005 Defense Evasion.
Run this benchmark in your terminal:
powerpipe benchmark run github_audit_log_detections.benchmark.mitre_attack_v161_ta0005Snapshot and share results via Turbot Pipes:
powerpipe benchmark run github_audit_log_detections.benchmark.mitre_attack_v161_ta0005 --share