Cross-source coverage
T1027.005 / ATT&CK
Obfuscated Files or Information: Indicator Removal from Tools
7 rules across 3 sources.
From MITRE ATT&CK 19.2
Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.
A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.
- Tactics
- Stealth
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:ApplicationWinEventLog:Sysmonauditd:SYSCALLlinux:osqueryEDR:detectionmacos:unifiedlogmacos:osquery
How MITRE says to detect it DET0189
Detection Strategy for Indicator Removal from Tools - Post-AV Evasion Modification
Windows Analytic 0540
Detection of known tools or malware flagged by antivirus, followed by a near-term drop of a similar binary with modified signature and resumed activity (execution, C2, or persistence).
WinEventLog:ApplicationEventCode=1000WinEventLog:SysmonEventCode=1WinEventLog:SysmonEventCode=11
Linux Analytic 0541
Detection of anti-malware quarantining or flagging a tool, followed by a new binary written to disk with a similar function or name and a resumed process chain.
auditd:SYSCALLexecveauditd:SYSCALLopen, renamelinux:osqueryfile_eventsEDR:detectionThreatDetected, QuarantineLog
macOS Analytic 0542
Detection of XProtect or AV quarantining a known tool, followed by modification (file size, hash, string) and subsequent re-execution by the same or related user.
macos:unifiedlogquarantine or AV-related subsystemmacos:osqueryfile_events
SigmaHQ/sigma
4 rules| Detection | Severity | Format |
|---|---|---|
| HackTool - CrackMapExec PowerShell Obfuscation | High | Sigma |
| PUA - DefenderCheck Execution | High | Sigma |
| Potential Secure Deletion with SDelete | Medium | Sigma |
| PUA - Potential PE Metadata Tamper Using Rcedit | Medium | Sigma |
splunk/security_content
2 rules| Detection | Severity | Format |
|---|---|---|
| Powershell Creating Thread Mutex | Undefined | SPL |
| Powershell Enable SMB1Protocol Feature | Undefined | SPL |
socfortress/Wazuh-Rules
1 rule| Detection | Severity | Format |
|---|---|---|
| Powershell script: SMB1Protocol feature being enabled (ransomware lateral movement) | High | Wazuh XML |