log-evasion
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents numerous commands for system log management and manipulation, including wevtutil, auditctl, sed, and reg for modifying registry keys related to security logging.
- [PRIVILEGE_ESCALATION]: Includes methodologies that require administrative or root privileges, such as disabling Windows Event Log service threads, modifying file permissions of system logs using icacls, and stopping auditd on Linux.
- [DYNAMIC_EXECUTION]: Provides technical references and code snippets (C, C#, Python) for memory patching techniques, such as blinding ETW by patching EtwEventWrite and bypassing AMSI by patching AmsiScanBuffer in memory.
Audit Metadata