Obfuscated Files or Information: Indicator Removal from Tools
Other sub-techniques of Obfuscated Files or Information (5)
ID | Name |
---|---|
T1027.001 | Binary Padding |
T1027.002 | Software Packing |
T1027.003 | Steganography |
T1027.004 | Compile After Delivery |
T1027.005 | Indicator Removal from Tools |
Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.
A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.
Procedure Examples
Name | Description |
---|---|
APT3 |
APT3 has been known to remove indicators of compromise from tools.[1] |
Cobalt Strike |
Cobalt Strike includes a capability to modify the "beacon" payload to eliminate known signatures or unpacking methods.[2] |
Daserf |
Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.[3] |
Deep Panda |
Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.[4] |
GravityRAT |
The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document.[5] |
InvisiMole |
InvisiMole has undergone regular technical improvements in an attempt to evade detection.[6] |
OilRig |
OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.[7][8] |
Patchwork |
Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.[9] |
PowerSploit |
PowerSploit's |
Soft Cell |
Soft Cell ensured each payload had a unique hash, including by using different types of packers.[12] |
Sunburst |
Sunburst source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to Sunspot.[13] |
TEMP.Veles |
TEMP.Veles has modified files based on the open-source project cryptcat in an apparent attempt to decrease AV detection rates.[14] |
Turla |
Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.[15] |
Mitigations
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
Detection
The first detection of a malicious tool may trigger an anti-virus or other security tool alert. Similar events may also occur at the boundary through network IDS, email scanning appliance, etc. The initial detection should be treated as an indication of a potentially more invasive intrusion. The alerting system should be thoroughly investigated beyond that initial alert for activity that was not detected. Adversaries may continue with an operation, assuming that individual events like an anti-virus detect will not be investigated or that an analyst will not be able to conclusively link that event to other activity occurring on the network.
References
- Korban, C, et al. (2017, September). APT3 Adversary Emulation Plan. Retrieved January 16, 2018.
- Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017.
- Chen, J. and Hsieh, M. (2017, November 7). REDBALDKNIGHT/BRONZE BUTLER’s Daserf Backdoor Now Using Steganography. Retrieved December 27, 2017.
- DiMaggio, J.. (2015, August 6). The Black Vine cyberespionage group. Retrieved January 26, 2016.
- Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.
- Hromcova, Z. and Cherpanov, A. (2020, June). INVISIMOLE: THE HIDDEN PART OF THE STORY. Retrieved July 16, 2020.
- Falcone, R.. (2017, April 27). OilRig Actors Provide a Glimpse into Development and Testing Efforts. Retrieved May 3, 2017.
- Falcone, R., Wilhoit, K.. (2018, November 16). Analyzing OilRig’s Ops Tempo from Testing to Weaponization to Delivery. Retrieved April 23, 2019.
- Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
- PowerShellMafia. (2012, May 26). PowerSploit - A PowerShell Post-Exploitation Framework. Retrieved February 6, 2018.
- PowerSploit. (n.d.). PowerSploit. Retrieved February 6, 2018.
- Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
- CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.
- FireEye Intelligence . (2018, October 23). TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers. Retrieved April 16, 2019.
- ESET. (2017, August). Gazing at Gazer: Turla’s new second stage backdoor. Retrieved September 14, 2017.