Indicator Removal on Host

APT29 removed evidence of email export requests using Remove-MailboxExportRequest.^[1] They temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.^[2]

Bankshot deletes all artifacts associated with the malware from the infected machine.^[3]

Bazar's loader can delete scheduled tasks created by a previous instance of the malware.^[4]

BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.^[5]

CSPY Downloader has the ability to remove values it writes to the Registry.^[6]

EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.^[7]

Goopy has the ability to delete emails used for C2 once the content has been copied.^[8]

GrimAgent can delete previously created tasks on a compromised host.^[9]

Maze has used the "Wow64RevertWow64FsRedirection" function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.^[10]

MCMD has the ability to remove set Registry Keys.^[11]

Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.^[12]

Misdat is capable of deleting Registry keys used for persistence.^[13]

njRAT is capable of deleting objects related to itself (registry keys, files, and firewall rules) on the victim.^[14][15]

Orz can overwrite Registry settings to reduce its visibility on the victim.^[16]

Pillowmint can uninstall the malicious service from an infected machine.^[17]

PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.^[18]

After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.^[19]

Rising Sun can clear process memory by overwriting it with junk bytes.^[20]

RTM has the ability to remove Registry entries that it created during execution.^[21]

SDBbot has the ability to clean up and remove data structures from a compromised host.^[22]

ShadowPad has deleted arbitrary Registry values.^[23]

Sibot will delete an associated registry key if a certain server response is received.^[24]

Stuxnet removes itself from the system through a DLL export by deleting specific files and stored procedures.^[25]

SUNBURST removed IFEO values to clean up traces of execution.^[26]

Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.

Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.