Indicator Removal on Host
Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.
These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.
Procedure Examples
Name | Description |
---|---|
Bankshot |
Bankshot deletes all artifacts associated with the malware from the infected machine.[1] |
Goopy |
Goopy has the ability to delete emails used for C2 once the content has been copied.[2] |
Maze |
Maze has used the "Wow64RevertWow64FsRedirection" function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.[3] |
MCMD | |
Metamorfo |
Metamorfo has a command to delete a Registry key it uses, |
Misdat |
Misdat is capable of deleting Registry keys used for persistence.[6] |
njRAT |
njRAT is capable of deleting objects related to itself (registry keys, files, and firewall rules) on the victim.[7][8] |
Orz |
Orz can overwrite Registry settings to reduce its visibility on the victim.[9] |
Pillowmint |
Pillowmint can uninstall the malicious service from an infected machine.[10] |
PoetRAT |
PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.[11] |
Prikormka |
After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.[12] |
Rising Sun |
Rising Sun can clear process memory by overwriting it with junk bytes.[13] |
RTM |
RTM has the ability to remove Registry entries that it created during execution.[14] |
SDBot |
SDBot has the ability to clean up and remove data structures from a compromised host.[15] |
Sunburst |
Sunburst removed IFEO values to clean up traces of execution.[16] |
UNC2452 |
UNC2452 removed evidence of email export requests using |
Mitigations
Mitigation | Description |
---|---|
Encrypt Sensitive Information |
Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary. |
Remote Data Storage |
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system. |
Restrict File and Directory Permissions |
Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities. |
Detection
File system monitoring may be used to detect improper deletion or modification of indicator files. Events not stored on the file system may require different detection mechanisms.
References
- US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.
- Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
- Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.
- Secureworks. (2019, July 24). MCMD Malware Analysis. Retrieved August 13, 2020.
- Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.
- Gross, J. (2016, February 23). Operation Dust Storm. Retrieved September 19, 2017.
- Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: "njRAT" Uncovered. Retrieved June 4, 2019.
- Pascual, C. (2018, November 27). AutoIt-Compiled Worm Affecting Removable Media Delivers Fileless Version of BLADABINDI/njRAT Backdoor. Retrieved June 4, 2019.
- Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
- Trustwave SpiderLabs. (2020, June 22). Pillowmint: FIN7’s Monkey Thief . Retrieved July 27, 2020.
- Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.
- Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.
- Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.
- Faou, M. and Boutin, J. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
- Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
- MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.
- Cash, D. et al. (2020, December 14). Dark Halo Leverages SolarWinds Compromise to Breach Organizations. Retrieved December 29, 2020.
- FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.