Indicator Removal on Host
Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.
Procedure Examples
| Name | Description |
|---|---|
| Bankshot |
Bankshot deletes all artifacts associated with the malware from the infected machine.[3] |
| Goopy |
Goopy has the ability to delete emails used for C2 once the content has been copied.[10] |
| MAZE |
MAZE has used the "Wow64RevertWow64FsRedirection" function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.[8] |
| Misdat |
Misdat is capable of deleting Registry keys used for persistence.[4] |
| Orz |
Orz can overwrite Registry settings to reduce its visibility on the victim.[1] |
| PoetRAT |
PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.[6] |
| Prikormka |
After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.[5] |
| Rising Sun |
Rising Sun can clear process memory by overwriting it with junk bytes.[7] |
| RTM |
RTM has the ability to remove Registry entries that it created during execution.[2] |
| SDBot |
SDBot has the ability to clean up and remove data structures from a compromised host.[9] |
Mitigations
| Mitigation | Description |
|---|---|
| Encrypt Sensitive Information |
Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary. |
| Remote Data Storage |
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system. |
| Restrict File and Directory Permissions |
Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities. |
Detection
File system monitoring may be used to detect improper deletion or modification of indicator files. Events not stored on the file system may require different detection mechanisms.
References
- Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
- Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
- US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.
- Gross, J. (2016, February 23). Operation Dust Storm. Retrieved September 19, 2017.
- Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.
- Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.
- Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
- Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.
- Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
- Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.