Detecting APT Simulator Defense Evasion Techniques with ES|QL

Author: Security Research Team Date: November 8, 2025 Tools: Elastic Security, ES|QL, Elastic Defend, Windows Sysmon

Executive Summary

This document provides a comprehensive analysis of detecting defense evasion techniques simulated by APTSimulator, a Windows batch script framework designed to make systems look compromised. We developed and validated ES|QL detection queries against five defense evasion simulations, uncovering critical insights about command-line parsing, file header analysis, and the importance of understanding actual logged data formats.

Key Findings:

• Successfully detected 3 out of 5 techniques with ES|QL queries
• Discovered command-line logging formats double-space between executables and arguments
• File header analysis (magic bytes) effectively detects obfuscation attempts
• Some techniques require alternative detection approaches (file integrity monitoring)

Introduction

Defense evasion techniques are a critical part of the MITRE ATT&CK framework, representing adversary attempts to avoid detection during intrusions. APTSimulator provides a safe, controlled environment to test detection capabilities against realistic attack simulations.

This research focuses on five defense evasion techniques from APTSimulator's test suite:

1. Creating fake system files in suspicious locations
2. JavaScript dropper using certutil and wscript
3. File obfuscation (RAR archive disguised as JPG)
4. 7-Zip extraction of obfuscated payloads
5. Windows hosts file manipulation

Our goal: develop production-ready ES|QL queries to detect these techniques in real-time using Elastic Security.

Testing Environment

Infrastructure

• Elasticsearch Version: 8.x
• Data Streams: .ds-logs-endpoint.events. (Elastic Defend), .ds-logs-windows.sysmon_operational. (Sysmon)
• Test System: Windows 10/11 with Elastic Agent + Sysmon
• Simulation Tool: APTSimulator v0.9+

Technique 1: Fake System File

APTSimulator's fake-system-file.bat creates a file named svchost.exe in a non-standard location (C:\TMP\), mimicking a common technique where attackers disguise malicious executables with legitimate Windows process names.

FROM .ds-logs-endpoint.events.*, .ds-logs-windows.sysmon_operational.*
| WHERE event.category == "file"
  AND event.action == "creation"
  AND file.name IN ("svchost.exe", "lsass.exe", "csrss.exe", "winlogon.exe", "smss.exe")
  AND NOT file.path RLIKE "C:\\Windows\\System32\\%"
  AND NOT file.path RLIKE "C:\\Windows\\SysWOW64\\%"

Result: ✅ Detected — query successfully identifies suspicious system file creation.

MITRE ATT&CK: TA0005 Defense Evasion — T1036.005 Masquerading: Match Legitimate Name or Location.

Technique 2: JS Dropper (certutil + wscript)

The js-dropper.bat simulation demonstrates a two-stage attack: certutil.exe downloads a JavaScript file, then wscript.exe executes it.

Critical discovery: logged command lines contain two spaces between the executable and the first argument — "wscript.exe C:\Users\Public\en-US.js", not one. This insight was crucial for successful detection.

FROM .ds-logs-endpoint.events.*, .ds-logs-windows.sysmon_operational.*
| WHERE process.name == "certutil.exe"
  AND process.command_line LIKE "certutil.exe  %-urlcache%"
  OR (
    process.name == "wscript.exe"
    AND process.command_line LIKE "wscript.exe  %en-US.js%"
  )

A broader, more generic version for non-APTSimulator environments:

FROM .ds-logs-endpoint.events.*, .ds-logs-windows.sysmon_operational.*
| WHERE (
    process.name == "certutil.exe"
    AND process.command_line LIKE "%urlcache%"
  )
  OR (
    process.name == "wscript.exe"
    AND (
      process.command_line LIKE "%\\Temp\\%.js%"
      OR process.command_line LIKE "%\\Public\\%.js%"
      OR process.command_line LIKE "%\\AppData\\%.js%"
    )
  )

Result: ✅ Detected — 2 events for certutil download, 2 events for wscript execution.

MITRE ATT&CK: T1140, T1105, T1059.007.

Technique 3: Obfuscation via File Header Mismatch

The obfuscation1.bat simulation extracts a RAR archive (s01.jpg) that masquerades as a JPEG image, containing WMIBackdoor.ps1, a PowerShell backdoor script.

By analyzing file.Ext.header_bytes, the actual header was 526172211a0700... — 526172 = "Rar!" in ASCII, i.e. a RAR archive, not a JPEG.

FROM .ds-logs-endpoint.events.*, .ds-logs-windows.sysmon_operational.*
| WHERE event.category == "file"
  AND event.action == "creation"
  AND file.Ext.header_bytes IS NOT NULL
  AND (
    (file.extension IN ("jpg", "jpeg", "png", "gif", "bmp", "txt", "doc")
     AND file.Ext.header_bytes LIKE "526172%")
    OR (file.extension IN ("jpg", "jpeg", "png", "gif", "bmp", "txt", "doc")
        AND file.Ext.header_bytes LIKE "504b%")
    OR (file.extension NOT IN ("exe", "dll", "sys", "scr", "cpl", "ocx", "mui", "drv")
        AND file.Ext.header_bytes LIKE "4d5a%")
    OR (file.extension IN ("jpg", "jpeg", "png", "gif", "bmp", "txt")
        AND file.Ext.header_bytes LIKE "377abcaf271c%")
  )

Result: ✅ Detected — successfully identified the RAR archive with a JPG extension.

MITRE ATT&CK: T1027.002 Obfuscated Files or Information: Software Packing.

Technique 4: Obfuscation with 7z

APTSimulator uses 7z.exe to extract obfuscated files from password-protected archives. File creation events for extracted payloads weren't logged in this environment, but 7z.exe process execution and DLL loads were.

FROM .ds-logs-endpoint.events.*, .ds-logs-windows.sysmon_operational.*
| WHERE process.name == "7z.exe"
  AND (
    process.command_line LIKE "%e %"
    OR process.command_line LIKE "%-p%"
  )

Result: ⚠️ Partially detected — DLL load events confirmed (8 events), but file creation events for the extracted payload weren't captured, likely due to Elastic Defend configuration.

Technique 5: Hosts File Manipulation

The hosts-manipulation.bat script attempts to modify C:\Windows\System32\drivers\etc\hosts to redirect legitimate domains to malicious IPs.

FROM .ds-logs-endpoint.events.*, .ds-logs-windows.sysmon_operational.*
| WHERE process.name == "cmd.exe"
  AND process.command_line LIKE "%echo%"
  AND process.command_line LIKE "%System32\\drivers\\etc\\hosts%"

Result: ❌ Not detected — the echo command with redirection (>>) doesn't generate a process creation event, and file modification events for the hosts file weren't captured either. This requires an alternative approach:

FROM .ds-logs-endpoint.events.*, .ds-logs-windows.sysmon_operational.*
| WHERE event.category == "file"
  AND (event.action == "modification" OR event.action == "change")
  AND file.path LIKE "%\\drivers\\etc\\hosts%"

MITRE ATT&CK: T1564.003, T1027.

Key Lessons Learned

1. Command line parsing matters — Windows logs command lines with two spaces between the executable and first argument. LIKE patterns must match exact spacing to detect events.
2. File header analysis is powerful — magic byte detection catches RAR-as-JPEG, ZIP-as-image, and PE-with-fake-extension tricks. file.Ext.header_bytes gives you the first 16 bytes of file content.
3. Logging gaps exist — file redirection (echo >> file) and silent modifications in protected directories don't always generate events. Combine multiple data sources (Sysmon, Elastic Defend, File Integrity Monitoring).
4. Process execution vs. file events — write queries for both to maximize coverage: process execution catches the tool used, file events catch the artifact created.
5. Context matters for false positives — generic patterns like process.name == "certutil.exe" will fire on legitimate certificate operations. Add suspicious paths, command-line flags, and parent-process context to refine.

Summary Table: Detection Coverage

Overall detection rate: 60% (3/5 fully detected, 1/5 partially detected).

Conclusion

This research demonstrates that ES|QL provides powerful capabilities for detecting defense evasion techniques when queries are properly tuned to match actual logged data. The key discoveries — double-spacing in command lines and file header analysis — highlight the importance of empirical testing over assumptions.

While we achieved 60% full detection coverage, the remaining techniques aren't undetectable — they simply require different approaches like file integrity monitoring or filesystem scanning via OSQuery. A layered defense strategy combining multiple data sources and detection methods provides the most comprehensive coverage.

References

• APTSimulator
• MITRE ATT&CK
• Elastic Security
• ES|QL Documentation
• Sysmon

For questions or feedback, please reach out to sakshamtushar@gmail.com.