Register to stream ATT&CKcon 2.0 October 29-30

Indicator Removal on Host

Adversaries may delete or alter generated artifacts on a host system, including logs and potentially captured files such as quarantined malware. Locations and format of logs will vary, but typical organic system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/* .

Actions that interfere with eventing and other notifications that can be used to detect intrusion activity may compromise the integrity of security solutions, causing events to go unreported. They may also make forensic analysis and incident response more difficult due to lack of sufficient data to determine what occurred.

Clear Windows Event Logs

Windows event logs are a record of a computer's alerts and notifications. Microsoft defines an event as "any significant occurrence in the system or in a program that requires users to be notified or an entry added to a log." There are three system-defined sources of Events: System, Application, and Security.

Adversaries performing actions related to account management, account logon and directory service access, etc. may choose to clear the events in order to hide their activities.

The event logs can be cleared with the following utility commands:

  • wevtutil cl system
  • wevtutil cl application
  • wevtutil cl security

Logs may also be cleared through other mechanisms, such as PowerShell.

ID: T1070
Tactic: Defense Evasion
Platform: Linux, macOS, Windows
System Requirements: Clearing the Windows event logs requires Administrator permissions
Data Sources: File monitoring, Process monitoring, Process command-line parameters, API monitoring, Windows event logs
Defense Bypassed: Log analysis, Host intrusion prevention systems, Anti-virus
CAPEC ID: CAPEC-93
Contributors: Ed Williams, Trustwave, SpiderLabs
Version: 1.0

Mitigations

Mitigation Description
Encrypt Sensitive Information Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.
Remote Data Storage Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
Restrict File and Directory Permissions Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

Examples

Name Description
APT28 APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security. [19] [20]
APT29 APT29 used SDelete to remove artifacts from victims. [27]
APT32 APT32 has cleared select event log entries. [23]
APT38 APT38 clears Window Event logs and Sysmon logs from the system. [26]
Bankshot Bankshot delets all artifacts associated with the malware from the infected machine. [6]
BlackEnergy The BlackEnergy component KillDisk is capable of deleting Windows Event Logs. [7]
Dragonfly 2.0 Dragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys. [21] [22]
FIN5 FIN5 has cleared event logs from victims. [24]
FIN8 FIN8 has cleared logs during post compromise cleanup activities. [25]
FinFisher FinFisher clears the system event logs. [4] [5]
gh0st RAT gh0st RAT is able to wipe event logs. [11]
Hydraq Hydraq creates a backdoor through which remote attackers can clear all system event logs. [13] [14]
Misdat Misdat is capable of deleting Registry keys used for persistence. [8]
NotPetya NotPetya uses wevtutil to clear the Windows event logs. [18]
Olympic Destroyer Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil. [17]
Orz Orz can overwrite Registry settings to reduce its visibility on the victim. [2]
Prikormka After encrypting log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host. [9]
Proton Proton removes logs from /var/logs and /Library/logs. [10]
Pupy Pupy has a module to clear event logs with PowerShell. [1]
RTM RTM has the ability to remove Registry entries that it created during execution. [3]
RunningRAT RunningRAT contains code to clear event logs. [15]
SynAck SynAck clears event logs. [12]
Zeus Panda Zeus Panda can uninstall scripts and delete files to cover its track. [16]

Detection

File system monitoring may be used to detect improper deletion or modification of indicator files. For example, deleting Windows event logs (via native binaries [28], API functions [29], or PowerShell [30]) may generate an alterable event (Event ID 1102: "The audit log was cleared"). Events not stored on the file system may require different detection mechanisms.

References

  1. Nicolas Verdier. (n.d.). Retrieved January 29, 2018.
  2. Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.
  3. Faou, M. and Boutin, J.. (2017, February). Read The Manual: A Guide to the RTM Banking Trojan. Retrieved March 9, 2017.
  4. FinFisher. (n.d.). Retrieved December 20, 2017.
  5. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  6. US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.
  7. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved May 18, 2016.
  8. Gross, J. (2016, February 23). Operation Dust Storm. Retrieved September 19, 2017.
  9. Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.
  10. Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.
  11. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.
  12. Ivanov, A. et al.. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.
  13. Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.
  14. Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.
  15. Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.
  1. Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.
  2. Mercer, W. and Rascagneres, P. (2018, February 12). Olympic Destroyer Takes Aim At Winter Olympics. Retrieved March 14, 2019.
  3. Chiu, A. (2016, June 27). New Ransomware Variant "Nyetya" Compromises Systems Worldwide. Retrieved March 26, 2019.
  4. Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.
  5. Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.
  6. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  7. US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
  8. Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.
  9. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  10. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  11. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 6, 2018.
  12. Dunwoody, M. and Carr, N.. (2016, September 27). No Easy Breach DerbyCon 2016. Retrieved October 4, 2016.
  13. Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July 2, 2018.
  14. Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2, 2018.
  15. Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018.