T1027.005: T1027.005
Essential information
- MITRE technique ID
T1027.005- Confidence
- 100/100
- Revoked
- No
- Published
- 19/03/2020 22:27
- Modified
- 27/03/2026 01:11
- Author / Source
- The MITRE Corporation
Aliases
Indicator Removal from Tools
Platforms
windows macos linux
Description
Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.
A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.
Kill chain phases
| Kill chain | Phase |
|---|---|
| mitre-attack | defense-evasion |
Marking (TLP)
TLP:CLEAR Copyright 2015-2025, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.