T1027.005 Indicator Removal from Tools
Sub-technique of T1027 Obfuscated Files or Information
Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- HackTool - CrackMapExec PowerShell Obfuscationhightest · windows
- PUA - DefenderCheck Executionhightest · windows
- PUA - Potential PE Metadata Tamper Using Rceditmediumtest · windows
- Potential Secure Deletion with SDeletemediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.