Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.1
- Files and Antivirus Detection
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g0009 | Deep Panda | China |
| grp_g0093 | GALLIUM | — |
| grp_g1048 | UNC3886 | — |
| grp_g0049 | OilRig | Iran |
| grp_g0010 | Turla | Russia |
| grp_g0022 | APT3 | China |
| grp_g0040 | Patchwork | — |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.