Obfuscated Files or Information: Indicator Removal from Tools

Created the Wednesday 15 February 2023. Updated 1 year, 6 months ago.

Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.

A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.

Technique Identifier

T1027.005

Technique Tags

Defense Evasion malicious file modification payload modification signature evasion unique hash APT3

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Obfuscated Files or Information: Indicator Removal from Tools, Sub-technique T1027.005 - Enterprise | MITRE ATT&CK®