Every detection you make teaches the attacker something. If a tool gets caught for a specific reason, the next version simply removes that reason.
MITRE tracks this as Indicator Removal from Tools, technique T1027.005, a sub-technique of Obfuscated Files or Information in the Stealth tactic. It applies to Linux, macOS and Windows.
How attackers use it
Adversaries may remove indicators from a tool if they believe it was detected, quarantined or curtailed. They modify the tool, take out the indicator, and use the updated version, which no longer trips the same defenses. It may also work on later targets running similar security products.
MITRE's example: malware is quarantined by antivirus because of a file signature. The adversary works out that this was the cause, changes the file to avoid that signature and reuses it.
How to detect it
MITRE's strategy (DET0189) looks for the retry. A known tool or piece of malware is flagged, and soon after a similar binary appears with a modified signature and the same activity resumes, whether that is execution, command and control or persistence.
- Windows and Linux. A quarantine event followed by a new binary written to disk with a similar function or name, and a similar process chain.
- macOS. XProtect or antivirus quarantining a known tool, followed by changes in file size, hash or strings and re-execution by the same or a related user.
The practical move: do not close a quarantine alert as handled. Treat it as the start of an investigation. Ask what ran before the file was caught, and whether something similar showed up afterward.
How to reduce the risk
MITRE lists no specific mitigation for this sub-technique. Good habits:
- Route antivirus quarantine events into a place where a person reviews them, not just a log.
- Search for activity from the same user and host in the hours after a detection.
- Pair signature tools with behavior based detection so a modified file is still judged by what it does.
Quick check
What should an analyst do after antivirus quarantines a known tool?
Look for a similar file written soon afterward and for resumed activity by the same user or host. The attacker may have modified the tool to avoid the signature that caught it.
Sources
- MITRE ATT&CK, Indicator Removal from Tools (T1027.005)
