Red › Module 6 › Lesson 3
Evasion vs Crime
Lab-appropriate evasion literacy vs refused anti-forensics — $LAB_RT RoE defines the line; cover-tracks is not a skill goal.
Visual · t21_evasion_vs_crime
Evasion = reduce detection in RoE lab. Anti-forensics/cover-tracks = refused crime. Original Cyberlium.
Opening
Purple team may test whether detections fire — clearing logs on unauthorized systems is crime tradecraft, not capstone credit.
Evasion in authorized red team means operating within RoE to test whether blue detects TTPs — timing, noise reduction, OPSEC for lab IPs, brief-approved encoding — with mandatory teardown and no harm to strangers. Anti-forensics and cover-tracks — log clearing, timestomp, shredding evidence on systems you do not own, destroying audit trails to hide unauthorized access — are refused as Cyberlium skill goals and real-world crime. Cyberlium draws the line on $LAB_RT: document evasion hypotheses that improve detections; refuse teaching log wiping, event log deletion, or 'ghost mode' on neighbor networks. Defenders want honest purple feedback — not attackers who practice hiding from law enforcement.
1. Authorized evasion (literacy)
RoE-bounded OPSEC: lab C2 intervals, test obfuscation against YOUR detection rules, snapshot revert instead of hiding.
Purpose: validate whether SIEM/EDR catches the technique — purple loop, not permanent concealment.
Command guide
Try these commands — Authorized evasion (literacy)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Defense evasion literacy — https://attack.mitre.org/tactics/TA0005/ (vs criminal abuse) CISA ethics — https://www.cisa.gov/resources-tools/resources/red-team-exercises
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://attack.mitre.org/tactics/TA0005/ | grep -oE 'T[0-9]{4}' | sort -u | head -8
grep -iE 'never|evasion|crime' "$HOME/cyberlium-lab/t21-rt/roe.txt" "$HOME/cyberlium-lab/t21-rt/success-criteria.txt" 2>/dev/null | head -5Primary tools to practice this lesson: curl, grep. Reference sites: Defense evasion literacy (https://attack.mitre.org/tactics/TA0005/); CISA ethics (https://www.cisa.gov/resources-tools/resources/red-team-exercises). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Refused anti-forensics
Log clearing, timestomp, wiping USN journal, disabling auditing on unauthorized hosts — refused in course and often illegal.
Cover-tracks after stranger access is crime — not advanced red team; capstone integrity line says NO.
3. Defender and legal alignment
Immutable logging, centralized SIEM, WORM storage — assume attackers want cover-tracks; you practice detection uplift instead.
If RoE forbids a technique, stop — evasion never overrides written authorization.
4. What you ship: evasion vs crime boundary card
RoE evasion examples + refused anti-forensics list + purple detection purpose + signed integrity line.
5. What you record before the next lesson
Evasion vs crime boundary path.
6. Wrong vs right: stranger phishing vs authorized RT lab
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Clear Windows Security logs on café PC to 'practice evasion.'
Right
Boundary card written — evasion for detections, refuse cover-tracks. Next: Persist Lab.
Mission: evasion vs crime boundary
1) Define authorized evasion in RoE lab. 2) List five refused anti-forensics actions. 3) Write purple detection purpose line. 4) Sign NO cover-tracks integrity line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Snapshot revert vs log clear — which does Cyberlium allow?”
Knowledge Check
APPLY: Authorized evasion on Cyberlium:
Multiple choice
Knowledge Check
APPLY: True or False: Log clearing on unauthorized systems is advanced red team.
True or False
Knowledge Check
APPLY: Purple team evasion goal:
Multiple choice