Relocate Malware (MITRE ATT&CK T1070.010) is a Stealth technique. MITRE lists Linux, macOS, Windows and network devices as platforms.
After a payload lands, adversaries may copy it to new places on the victim system to remove evidence of presence or to avoid defenses. That may be combined with File Deletion to clean up older artifacts.
How attackers use it
MITRE gives several reasons for relocating a payload. It can be copied and renamed to blend into the environment, matching a legitimate resource name or location. It can be placed in paths that are excluded from scanning, or in locations tied to persistence.
It can also separate the payload from earlier events, such as User Execution and phishing, that may have raised alerts. MITRE notes that moving a payload into a target directory does not change its Creation timestamp, which helps it evade detection logic that relies on creation time changes, the kind of logic that would otherwise catch Timestomp.
How to detect it
MITRE's detection strategy has four analytics:
- Windows: copy or move actions across suspicious folders, such as Downloads to System32, followed by deletion of the original or renaming to look like legitimate binaries.
- Linux: movement of binaries between untrusted and trusted paths, such as /tmp/ to /usr/bin/ or /etc/init.d/.
- macOS: movement of binaries into ~/Library/, /System/ or app bundle locations, especially after a download from Safari or Mail.
- Network devices: relocation of firmware or scripts through CLI copy, move or rename between temporary partitions and startup configuration folders.
Collect file creation events with the writing process, and process creation with the image path. A binary that runs from a path where it did not originate is a good prompt to trace back.
How to reduce the risk
MITRE says this technique cannot be easily mitigated with preventive controls, since it abuses system features. Practical steps are to keep file integrity monitoring on system binary directories, and to keep endpoint telemetry that follows a file by hash and not just by path.
Quick check
Why does moving a file defeat creation-time based detections?
A move into a new directory does not change the file's Creation timestamp, so logic that looks for new creation times may not fire.
