Kill Chain — Defense Evasion Agent Response

When this fires: defense_evasion_agent detected one of: EventID 1102 (Security audit log cleared), Cortex XDR returning zero findings while other kill chain agents have elevated detections (EDR silence), or security tool process termination.

Severity: CRITICAL for EventID 1102 and EDR silence during active kill chain; HIGH for security tool process termination.

MITRE: T1070.001 (Indicator Removal: Clear Windows Event Logs), T1562 (Impair Defenses)

---

Alert Subtypes

Subtype	ioc_key Pattern	What It Means
Log cleared	{env}:host:{host}:log_cleared_1102	Attacker wiped Windows Security log to remove footprints
EDR silence	{env}:host:CORTEX-XDR:edr_silence_during_attack	Cortex shows 0 findings while other agents are elevated
Tool termination	{env}:host:{host}:security_tool_terminated	Cortex or Arctic Wolf agent process stopped

---

Response — EventID 1102 (Log Cleared)

Log clearing = an attacker is actively covering their tracks. This means they know they have been (or will be) detected and are cleaning up.

Critical note: Windows Security Event Log on the endpoint was cleared — but logs already forwarded to cirius-logging-law-central are still intact. LAW logs are your primary investigation source. The local event log on the host may be empty.

Step 1 — Identify the host and account:

SecurityEvent
| where TimeGenerated > ago(4h)
| where EventID == 1102
| extend Host = toupper(tostring(split(Computer, ".")[0]))
| project TimeGenerated, Host, Account, SubjectUserName

Step 2 — Pull the last activity from LAW before the log was cleared:

// What happened on this host in the hour before the log was cleared?
SecurityEvent
| where TimeGenerated > ago(8h)
| where Computer has "<hostname>"
| where TimeGenerated < datetime(<1102_timestamp>)
| project TimeGenerated, EventID, Account, NewProcessName, CommandLine,
    TargetUserName, IpAddress
| order by TimeGenerated desc
| take 200

Step 3 — Disable the account that cleared the log:

The account in EventID 1102 is compromised (or is the attacker). Disable it in Entra and revoke sessions immediately.

Step 4 — Isolate the host:

Cortex XDR → Endpoints → [host] → Actions → Isolate

Step 5 — Check all hosts that account touched in the last 24 hours:

Use the lateral movement KQL from runbooks/kill-chain-lateral-movement-response.md — an attacker clearing logs on one host may have moved to others.

---

Response — EDR Silence During Active Kill Chain

Cortex XDR returned zero findings in the same cycle that execution, lateral movement, or credential dumping agents fired CRITICAL/HIGH findings.

Follow the detailed procedure in runbooks/edr-silence-escalation.md.

Summary:

1. Check Cortex XDR console — does it show incidents for the affected host?
2. If yes, Cortex is running but the ingestion pipeline to SecOps is broken — fix the pipeline
3. If no — check the Cortex sensor status on the host
4. Sensor stopped or missing + kill chain activity = CRITICAL — isolate and engage Arctic Wolf

Arctic Wolf has independent visibility and can correlate without Cortex. Notify them immediately.

---

Response — Security Tool Process Terminated

1. Identify which tool's process was terminated (the finding will name it — e.g., CortexXDRSvc, Arctic Wolf sensor)
2. Attempt to restart:

   Start-Service CortexXDRSvc -ComputerName <hostname>

3. If the service won't restart, or restarting it results in the same process being killed again: the host is actively compromised. Do not attempt more restarts
4. Isolate the host via Cortex (if the management channel is still active — isolation can work even if the Cortex endpoint agent is stopped)
5. If Cortex isolation is unavailable: ask Arctic Wolf to isolate via their independent channel

---

Break-Glass Account Context

If a break-glass account appears in any log during the same time window as defense evasion activity:

• This is the highest-confidence active breach signal in the environment
• Break-glass accounts should never be used except in documented emergencies
• Defense evasion + break-glass activity = attacker has elevated access and is covering tracks

Escalation for this scenario:

1. Notify Rory via phone — not just Telegram
2. Engage Arctic Wolf immediately
3. Initiate the full IR plan: runbooks/incident-response.md
4. Document all break-glass account activity — it is permanently unsuppressible and always audit evidence

---

LAW Is Your Source of Truth

Remember: local log clearing (EventID 1102) only affects the Windows Security Event Log on the endpoint. All events already forwarded to cirius-logging-law-central remain intact and queryable. The attacker cannot reach LAW.

You have a full forensic picture in LAW regardless of what was cleared locally. Cortex XDR also retains alert history independently.

---

HIPAA Breach Assessment

Defense evasion combined with any other kill chain finding (execution, credential dumping, exfiltration) strongly suggests an attacker was present and actively evading detection. If the affected host had access to ePHI:

• Assume ePHI may have been accessed or exfiltrated
• Initiate the breach risk assessment per compliance/hipaa-breach-notification-procedure.md
• The risk assessment determines whether external notification is required

---

Escalation

Condition	Action
EventID 1102 alone, no other kill chain correlation	Rory notification, investigate account and host
EventID 1102 + other kill chain findings on same host	CRITICAL — Rory + Arctic Wolf, isolate immediately
EDR silence — pipeline issue	Fix pipeline, inform Rory
EDR silence — sensor down + kill chain active	CRITICAL — Rory + Arctic Wolf + possible IR plan
Break-glass + defense evasion	CRITICAL — Rory via phone + full IR plan

---

Post-Incident Checklist

• [ ] Account that cleared logs disabled, sessions revoked
• [ ] Host isolated
• [ ] LAW forensic query completed before any evidence ages out
• [ ] Cortex incident timeline documented
• [ ] Scope of attack determined using LAW (what the attacker did before clearing logs)
• [ ] Break-glass accounts reviewed — any unauthorized activation documented
• [ ] HIPAA breach assessment completed
• [ ] Palo Alto support case opened if Cortex sensor was successfully bypassed

---

Related Documents

• runbooks/edr-silence-escalation.md — detailed Cortex silence procedure
• runbooks/kill-chain-execution-response.md — often precedes defense evasion
• runbooks/incident-response.md — full IR plan
• compliance/hipaa-breach-notification-procedure.md
• runbooks/break-glass-procedure.md — if break-glass accounts are involved