Indicator Removal on Host

APT29 removed evidence of email export requests using Remove-MailboxExportRequest.^[1] They temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.^[2]

Bankshot deletes all artifacts associated with the malware from the infected machine.^[3]

Bazar's loader can delete scheduled tasks created by a previous instance of the malware.^[4]

BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.^[5]

CSPY Downloader has the ability to remove values it writes to the Registry.^[6]

DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.^[7]

Donut can erase file references to payloads in-memory after being reflectively loaded and executed.^[8]

EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.^[9]

Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.^[10]

Goopy has the ability to delete emails used for C2 once the content has been copied.^[11]

GrimAgent can delete previously created tasks on a compromised host.^[12]

HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.^[13][14]

KOCTOPUS can delete created registry keys as part of its cleanup procedure.^[15]

Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.^[16]

Maze has used the "Wow64RevertWow64FsRedirection" function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.^[17]

MCMD has the ability to remove set Registry Keys.^[18]

Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.^[19]

Misdat is capable of deleting Registry keys used for persistence.^[20]

Neoichor can clear the browser history on a compromised host by changing the ClearBrowsingHistoryOnExit value to 1 in the HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy Registry key.^[21]

njRAT is capable of manipulating and deleting registry keys.^[22]

Orz can overwrite Registry settings to reduce its visibility on the victim.^[23]

Pillowmint can uninstall the malicious service from an infected machine.^[24]

Rising Sun can clear process memory by overwriting it with junk bytes.^[25]

RTM has the ability to remove Registry entries that it created during execution.^[26]

SDBbot has the ability to clean up and remove data structures from a compromised host.^[27]

ShadowPad has deleted arbitrary Registry values.^[28]

Sibot will delete an associated registry key if a certain server response is received.^[29]

SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.^[30]

Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.^[31]

SUNBURST removed IFEO and HTTP proxy registry values to clean up traces of execution. SUNBURST also removed the firewall rules it created during execution.^[32]

Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.

Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.