T1027.005No distinct observable

Indicator Removal from Tools

StealthLinux, macOS, Windows

Where this stands

A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.

All three analytics in DET0189 are defined as a temporal correlation between two events, and the correlation is the whole detection. AN0540 is 'an antivirus flag, followed by a near-term drop of a similar binary with a modified signature'; AN0541 is 'anti-malware quarantining a tool, followed by a new binary with a similar function or name'; AN0542 is 'XProtect quarantining a tool, followed by modification and re-execution'. The tuning knobs are the correlation parameters themselves — TimeWindow (5-30 minutes between the alert and the re-drop), FilenameSimilarityThreshold and BinaryChangeThreshold (string or hash similarity between the original and the modified binary) — and lib/sigma supports no timeframe, no aggregation, no join and no cross-event similarity function, so the analytic cannot be expressed even in outline. […]

Covered instead by T1027, T1105.

What the technique is

Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.

Read it on attack.mitre.org

What MITRE says you would watch

AN0540
Detection of known tools or malware flagged by antivirus, followed by a near-term drop of a similar binary with modified signature and resumed activity (execution, C2, or persistence).
AN0541
Detection of anti-malware quarantining or flagging a tool, followed by a new binary written to disk with a similar function or name and a resumed process chain.
AN0542
Detection of XProtect or AV quarantining a known tool, followed by modification (file size, hash, string) and subsequent re-execution by the same or related user.