Indicator Removal

APT5 has used the THINBLOOD utility to clear SSL VPN log files located at /home/runtime/logs.^[1][2]

Bankshot deletes all artifacts associated with the malware from the infected machine.^[3]

BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.^[4]

BPFDoor clears the file location /proc/<PID>/environ removing all environment variables for the process.^[5]

CSPY Downloader has the ability to remove values it writes to the Registry.^[6]

During Cutting Edge, threat actors cleared logs to remove traces of their activity and restored compromised systems to a clean state to bypass manufacturer mitigations for CVE-2023-46805 and CVE-2024-21887.^[7][8]

DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.^[9]

Donut can erase file references to payloads in-memory after being reflectively loaded and executed.^[10]

DUSTTRAP restores the .text section of compromised DLLs after malicious code is loaded into memory and before the file is closed.^[11]

EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.^[12]

Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.^[13]

FunnyDream has the ability to clean traces of malware deployment.^[14]

HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.^[15][16]

IPsec Helper can delete various registry keys related to its execution and use.^[17]

Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.^[18]

Maze has used the "Wow64RevertWow64FsRedirection" function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.^[19]

Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.^[20]

MultiLayer Wiper uses a batch script to clear file system cache memory via the ProcessIdleTasks export in advapi32.dll as an anti-analysis and anti-forensics technique.^[21]

Neoichor can clear the browser history on a compromised host by changing the ClearBrowsingHistoryOnExit value to 1 in the HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy Registry key.^[22]

Orz can overwrite Registry settings to reduce its visibility on the victim.^[23]

Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.^[24]

Sardonic has the ability to delete created WMI objects to evade detections.^[25]

SDBbot has the ability to clean up and remove data structures from a compromised host.^[26]

ShadowPad has deleted arbitrary Registry values.^[27]

Sibot will delete an associated registry key if a certain server response is received.^[28]

SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.^[29]

During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.^[30]

Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.^[31]

SUNBURST removed HTTP proxy registry values to clean up traces of execution.^[32]

Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.

Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.