MITRE ATT&CK - Техника Удаление признаков активности из системы

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Удаление признаков активности из системы

Sub-techniques (9)

ID	Name
.001	Очистка журналов событий Windows
.002	Очистка системных журналов Linux или Mac
.003	Очистка истории команд
.004	Удаление файлов
.005	Удаление подключений к общим сетевым ресурсам
.006	Изменение временных меток
.007	Очистка истории сетевых соединений и конфигураций
.008	Очистка почтового ящика
.009	Удаление индикаторов компрометации

Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform. Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

ID: T1070

Суб-техники: .001 .002 .003 .004 .005 .006 .007 .008 .009

Тактика(-и): Defense Evasion

Платформы: Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows

Источники данных: Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification

Версия: 2.0

Дата создания: 31 May 2017

Последнее изменение: 21 Oct 2022

Название	Описание
Примеры процедур
Donut	Donut can erase file references to payloads in-memory after being reflectively loaded and executed.(Citation: Donut Github)
SDBbot	SDBbot has the ability to clean up and remove data structures from a compromised host.(Citation: Proofpoint TA505 October 2019)
Metamorfo	Metamorfo has a command to delete a Registry key it uses, `\Software\Microsoft\Internet Explorer\notes`.(Citation: FireEye Metamorfo Apr 2018)
ShadowPad	ShadowPad has deleted arbitrary Registry values.(Citation: Kaspersky ShadowPad Aug 2017)
BlackEnergy	BlackEnergy has removed the watermark associated with enabling the `TESTSIGNING` boot configuration option by removing the relevant strings in the `user32.dll.mui` of the system.(Citation: F-Secure BlackEnergy 2014)
MCMD	MCMD has the ability to remove set Registry Keys.(Citation: Secureworks MCMD July 2019)
EVILNUM	EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.(Citation: Prevailion EvilNum May 2020)
SILENTTRINITY	SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.(Citation: GitHub SILENTTRINITY Modules July 2019)
S-Type	S-Type has deleted accounts it has created.(Citation: Cylance Dust Storm)
Orz	Orz can overwrite Registry settings to reduce its visibility on the victim.(Citation: Proofpoint Leviathan Oct 2017)
Goopy	Goopy has the ability to delete emails used for C2 once the content has been copied.(Citation: Cybereason Cobalt Kitty 2017)
HermeticWiper	HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.(Citation: Crowdstrike DriveSlayer February 2022)(Citation: ESET Hermetic Wizard March 2022)
APT29	APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.(Citation: FireEye SUNBURST Backdoor December 2020)
Metamorfo	Metamorfo has a command to delete a Registry key it uses, `\Software\Microsoft\Internet Explorer\notes`.(Citation: FireEye Metamorfo Apr 2018)
CSPY Downloader	CSPY Downloader has the ability to remove values it writes to the Registry.(Citation: Cybereason Kimsuky November 2020)
ShadowPad	ShadowPad has deleted arbitrary Registry values.(Citation: Kaspersky ShadowPad Aug 2017)
Bazar	Bazar's loader can delete scheduled tasks created by a previous instance of the malware.(Citation: NCC Group Team9 June 2020)
Stuxnet	Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.(Citation: Symantec W.32 Stuxnet Dossier)
Rising Sun	Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.(Citation: McAfee Sharpshooter December 2018)
RTM	RTM has the ability to remove Registry entries that it created during execution.(Citation: ESET RTM Feb 2017)
Sibot	Sibot will delete an associated registry key if a certain server response is received.(Citation: MSTIC NOBELIUM Mar 2021)
Pillowmint	Pillowmint can uninstall the malicious service from an infected machine.(Citation: Trustwave Pillowmint June 2020)
FunnyDream	FunnyDream has the ability to clean traces of malware deployment.(Citation: Bitdefender FunnyDream Campaign November 2020)
UNC2452	UNC2452 removed evidence of email export requests using `Remove-MailboxExportRequest`.(Citation: Volexity SolarWinds) They temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.(Citation: FireEye SUNBURST Backdoor December 2020)
Lazarus Group	Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.(Citation: Lazarus APT January 2022)
Maze	Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.(Citation: McAfee Maze March 2020)
Sibot	Sibot will delete an associated registry key if a certain server response is received.(Citation: MSTIC NOBELIUM Mar 2021)
Misdat	Misdat is capable of deleting Registry keys used for persistence.(Citation: Cylance Dust Storm)
CSPY Downloader	CSPY Downloader has the ability to remove values it writes to the Registry.(Citation: Cybereason Kimsuky November 2020)
Bankshot	Bankshot deletes all artifacts associated with the malware from the infected machine.(Citation: US-CERT Bankshot Dec 2017)
Flagpro	Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.(Citation: NTT Security Flagpro new December 2021)
njRAT	njRAT is capable of deleting objects related to itself (registry keys, files, and firewall rules) on the victim.(Citation: Fidelis njRAT June 2013)(Citation: Trend Micro njRAT 2018)
DarkWatchman	DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.(Citation: Prevailion DarkWatchman 2021)
SUNBURST	SUNBURST removed HTTP proxy registry values to clean up traces of execution.(Citation: Microsoft Deep Dive Solorigate January 2021)
Neoichor	Neoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy` Registry key.(Citation: Microsoft NICKEL December 2021)

Контрмера	Описание
Контрмеры
Encrypt Sensitive Information	Protect sensitive information with strong encryption.
Remote Data Storage	Use remote security log and sensitive file storage where access can be controlled better to prevent exposure of intrusion detection log data or sensitive information.
Restrict File and Directory Permissions	Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
Indicator Removal on Host Mitigation	Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system. Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities. Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.

Обнаружение

File system monitoring may be used to detect improper deletion or modification of indicator files. Events not stored on the file system may require different detection mechanisms.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.