Thanks to all of our ATT&CKcon participants. All sessions are here, and individual presentations will be posted soon.

Indicator Removal on Host

Adversaries may delete or alter generated artifacts on a host system, including logs and potentially captured files such as quarantined malware. Locations and format of logs will vary, but typical organic system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/* .

Actions that interfere with eventing and other notifications that can be used to detect intrusion activity may compromise the integrity of security solutions, causing events to go unreported. They may also make forensic analysis and incident response more difficult due to lack of sufficient data to determine what occurred.

Clear Windows Event Logs

Windows event logs are a record of a computer's alerts and notifications. Microsoft defines an event as "any significant occurrence in the system or in a program that requires users to be notified or an entry added to a log." There are three system-defined sources of Events: System, Application, and Security.

Adversaries performing actions related to account management, account logon and directory service access, etc. may choose to clear the events in order to hide their activities.

The event logs can be cleared with the following utility commands:

  • wevtutil cl system
  • wevtutil cl application
  • wevtutil cl security

Logs may also be cleared through other mechanisms, such as PowerShell.

ID: T1070

Tactic: Defense Evasion

Platform:  Linux, macOS, Windows

Data Sources:  File monitoring, Process monitoring, Process command-line parameters, API monitoring, Windows event logs

Defense Bypassed:  Log analysis, Host intrusion prevention systems, Anti-virus

CAPEC ID:  CAPEC-93

Contributors:  Ed Williams, Trustwave, SpiderLabs

Version: 1.0

Examples

NameDescription
APT28

APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.[1][2]

APT29

APT29 used SDelete to remove artifacts from victims.[3]

APT32

APT32 has cleared select event log entries.[4]

Bankshot

Bankshot delets all artifacts associated with the malware from the infected machine.[5]

BlackEnergy

The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.[6]

Dragonfly 2.0

Dragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.[7][8]

FIN5

FIN5 has cleared event logs from victims.[9]

FIN8

FIN8 has cleared logs during post compromise cleanup activities.[10]

FinFisher

FinFisher clears the system event logs.[11][12]

gh0st

gh0st RAT is able to wipe event logs.[13]

Hydraq

Hydraq creates a backdoor through which remote attackers can clear all system event logs.[14][15]

Misdat

Misdat is capable of deleting Registry keys used for persistence.[16]

Orz

Orz can overwrite Registry settings to reduce its visibility on the victim.[17]

Prikormka

After encrypting log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.[18]

Proton

Proton removes logs from /var/logs and /Library/logs.[19]

Pupy

Pupy has a module to clear event logs with PowerShell.[20]

RTM

RTM has the ability to remove Registry entries that it created during execution.[21]

RunningRAT

RunningRAT contains code to clear event logs.[22]

SynAck

SynAck clears event logs.[23]

Mitigation

Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system. Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities. Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.

Detection

File system monitoring may be used to detect improper deletion or modification of indicator files. For example, deleting Windows event logs (via native binaries [24], API functions [25], or PowerShell [26]) may generate an alterable event (Event ID 1102: "The audit log was cleared"). Events not stored on the file system may require different detection mechanisms.

References

  1. Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.
  2. Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved September 13, 2018.
  3. Dunwoody, M. and Carr, N.. (2016, September 27). No Easy Breach DerbyCon 2016. Retrieved October 4, 2016.
  4. Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.
  5. US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.
  6. Cherepanov, A.. (2016, January 3). BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry. Retrieved May 18, 2016.
  7. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  8. US-CERT. (2017, October 20). Alert (TA17-293A): Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved November 2, 2017.
  9. Bromiley, M. and Lewis, P. (2016, October 7). Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years. Retrieved October 6, 2017.
  10. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  11. FinFisher. (n.d.). Retrieved December 20, 2017.
  12. Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.
  13. FireEye Threat Intelligence. (2015, July 13). Demonstrating Hustle, Chinese APT Groups Quickly Use Zero-Day Vulnerability (CVE-2015-5119) Following Hacking Team Leak. Retrieved January 25, 2016.