Indicator Removal detection rulesT1070

Clear command history in network OS which is used for defense evasion

cisco

Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

windows · ps_script

Detects usage of powershell cmdlets to disable or remove ETW trace sessions

windows · ps_script

Detects scripts or commands that disabled the Powershell command history by removing psreadline module

windows · ps_script

Detects command line activity that tries to clear or disable any ETW trace log which could be a sign of logging evasion.

windows · process_creation

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detects suspicious parameters of fsutil (deleting USN journal, configuring it with small size, etc). Might be used by ransomwares during the attack (seen by NotPetya and others).

windows · process_creation

Detects commands that try to clear or tamper with the Linux command history. This technique is used by threat actors in order to evade defenses and execute commands without them being recorded in files such as "bash_history" or "zsh_history".

linux

Detects the deletion of a prefetch file which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detects removal of an exported Exchange mailbox which could be to cover tracks from ProxyShell exploit

windows

Detects deletion of the RunMRU registry key, which stores the history of commands executed via the Run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands.

windows · process_creation

Detects attempts to delete the RunMRU registry key, which stores the history of commands executed via the run dialog. In the clickfix techniques, the phishing lures instruct users to open a run dialog through (Win + R) and execute malicious commands. Adversaries may delete this key to cover their tracks after executing commands.

windows · registry_delete

Shadow Copies deletion using operating systems utilities

windows · process_creation

Detects a method often used by ransomware. Which combines the "ping" to wait a couple of seconds and then "del" to delete the file in question. Its used to hide the file responsible for the initial infection for example

windows · process_creation

Detects possible Sysmon filter driver unloaded via fltmc.exe

windows · process_creation

Detects the deletion of registry keys containing the MSTSC connection history

windows · registry_delete

Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

windows · file_delete

Detects backup catalog deletions

windows

See what files are being deleted from flash file systems

cisco

Detects keywords that could indicate clearing PowerShell history

windows · ps_script

Detects keywords that could indicate clearing PowerShell history

windows · ps_module

Administrative shares are hidden network shares created by Microsoft Windows NT operating systems that grant system administrators remote access to every disk volume on a network-connected system

windows · registry_set

Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"

windows · image_load

Detects the deletion of the event log files which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detects the deletion of files by the Sysinternals SDelete utility. It looks for the common name pattern used to rename files.

windows · file_delete

Detect file time attribute change to hide new or changes to existing files

macos · process_creation

Detect file time attribute change to hide new or changes to existing files.

linux

Detect filter driver unloading activity via fltmc.exe

windows · process_creation

Detects execution of the "del" builtin command to remove files using greedy/wildcard expression. This is often used by malware to delete content of folders that perhaps contains the initial malware infection or to delete evidence.

windows · process_creation

Detects the deletion of IIS WebServer access logs which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. Threat actors often abuse vulnerabilities in web applications hosted on IIS servers to gain initial access and later delete IIS logs to evade detection.

windows · process_creation

Detects when events are deleted in Kubernetes. An adversary may delete Kubernetes events in an attempt to evade detection.

kubernetes · application

Detects potential malicious and unauthorized usage of bcdedit.exe

windows · process_creation

Detects files that have extensions commonly seen while SDelete is used to wipe files.

windows

Detects uncommon and potentially suspicious one-liner command containing both "ping" and "copy" at the same time, which is usually used by malware.

windows · process_creation

Detects the deletion of the PowerShell console History logs which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

windows · ps_script

Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.

windows · ps_script

Detects an instance of an SES identity being deleted via the "DeleteIdentity" event. This may be an indicator of an adversary removing the account that carried out suspicious or malicious activities

aws

Open a handle on the drive volume via the \\.\ DOS device path specifier and perform direct access read of the first few bytes of the volume.

windows · ps_script

Detects the deletion of tomcat WebServer logs which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detects usage of the "touch" process in service file.

linux · process_creation

Detects PowerShell scripts that try to access the default Windows MailApp MailBox. This indicates manipulation of or access to the stored emails of a user. E.g. this could be used by an attacker to exfiltrate or delete the content of the emails.

windows · ps_script

Detects file access requests to Windows Outlook Mail by uncommon processes. Could indicate potential attempt of credential stealing. Requires heavy baselining before usage

windows · file_access

Detects the deletion of the "Zone.Identifier" ADS. Attackers can leverage this in order to bypass security restrictions that make use of the ADS such as Microsoft Office apps.

windows · file_delete

Detects execution of the builtin "rmdir" command in order to delete directories. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

windows · process_creation

Detects when the file creation time is changed to a year before 2020. Attackers may change the file creation time of a backdoor to make it look like it was installed with the operating system. Note that many processes legitimately change the creation time of a file; it does not necessarily indicate malicious activity. In order to use this rule in production, it is recommended first baseline normal behavior in your environment and then tune the rule accordingly. Hunting Recommendation: Focus on files with creation times set to years significantly before the current date, especially those in user-writable directories. Correlate with process execution logs to identify the source of the modification and investigate any unsigned or suspicious binaries involved.

windows · file_change

Detects execution of the builtin "del"/"erase" commands in order to delete files. Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

windows · process_creation

Detects linux package removal using builtin tools such as "yum", "apt", "apt-get" or "dpkg".

linux · process_creation

Detects changes to the "MaxMpxCt" registry value. MaxMpxCt specifies the maximum outstanding network requests for the server per client, which is used when negotiating a Server Message Block (SMB) connection with a client. Note if the value is set beyond 125 older Windows 9x clients will fail to negotiate. Ransomware threat actors and operators (specifically BlackCat) were seen increasing this value in order to handle a higher volume of traffic.

windows · registry_set

Detects the deletion of the TeamViewer log files which may indicate an attempt to destroy forensic evidence

windows · file_delete

Detect scenarios where a potentially unauthorized application or user is modifying the system time.

windows

Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

windows · process_creation

PowerShell Remove-Item with -Path to delete a file or a folder with "-Recurse"

windows · ps_script

Detects file deletion using "rm", "shred" or "unlink" commands which are used often by adversaries to delete files left behind by the actions of their intrusion activity

linux · process_creation