T1027.005 — Indicator Removal from Tools

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets…

Sub-technique of Obfuscated Files or Information (T1027).

Sigma detection rules (3)

T1027.005 Obfuscated Files or Information: Indicator Removal from Tools

title: "T1027.005 Obfuscated Files or Information: Indicator Removal from Tools"
id: 9562541a-320c-4386-8615-483f9d11c211
description: 'Detection Strategy for Indicator Removal from Tools - Post-AV-Detection Modification. Detects Windows Defender flagging/quarantining a tool (EventID 1116/1117), the precursor event an adversary must observe before modifying and re-deploying a detected tool. NOTE: the actual act of an adversary editing a binary to strip the signature that triggered detection happens off-host in the adversary toolchain and is not observable via any single Windows event; the true detection strategy requires correlating this AV-detection event with a later FileCreate (Sysmon EventID 11) of a similarly-named/pathed executable on the same host, a cross-event hunting pattern rather than something a single Sigma detection rule can express. (Data Component: Antivirus Detection; baseline tier: windows-eventid.) Tune using: AVAlertMessage, TimeWindow, FilenameSimilarityThreshold.'
references:
  - https://attack.mitre.org/techniques/T1027/005
author: Shahrukh Khan
date: 2026-05-03
license: MIT
tags:
  - attack.stealth
  - attack.t1027.005

logsource:
  product: windows
  service: windefend

detection:
  selection_av_detection:
    EventID:
      - 1116
      - 1117

  condition: selection_av_detection

falsepositives:
  - Routine antivirus detections of genuinely unwanted/test software (EICAR, pentest tooling) not followed by any indicator-removal activity; this rule only flags the AV-detection precursor event and requires manual/hunt-level follow-up to confirm re-deployment of a modified tool.

level: low

T1027.005 Obfuscated Files or Information: Indicator Removal from Tools

title: "T1027.005 Obfuscated Files or Information: Indicator Removal from Tools"
id: b1f78cad-9a7f-43df-9697-883458bea342
description: 'Detection Strategy for Indicator Removal from Tools - Post-AV Evasion Modification. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Bare strip execution matches routine build/release packaging pipelines constantly and has no correlation to a prior detection/quarantine event, which is the actual technique behavior of re-modifying a previously-flagged tool. Scoped to strip invocations whose target file argument matches PathWatchlist, a maintained list of paths/hashes previously flagged or quarantined by AV/EDR, so the rule only fires when a known-bad artifact is being re-stripped rather than on every build. Tune using: PathWatchlist, ProcessAncestryDepth.'
references:
  - https://attack.mitre.org/techniques/T1027/005
author: Shahrukh Khan
date: 2026-06-14
license: MIT
tags:
  - attack.stealth
  - attack.t1027.005

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith: '/strip'
  filter_watchlist:
    a1|contains|expand: '%PathWatchlist%'
  condition: selection and filter_watchlist

falsepositives:
  - PathWatchlist must be actively maintained from AV/EDR quarantine events for this rule to fire meaningfully; an empty or stale watchlist will silently produce zero detections rather than false positives.
  - Legitimate re-stripping of a file that was quarantined due to an unrelated false-positive AV signature.

level: high

T1027.005 Obfuscated Files or Information: Indicator Removal from Tools

title: "T1027.005 Obfuscated Files or Information: Indicator Removal from Tools"
id: c06823f0-8d23-458a-8c82-76b7f7c364d3
description: 'Detection Strategy for Indicator Removal from Tools - Post-AV Evasion Modification. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BinaryChangeThreshold, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1027/005
author: Shahrukh Khan
date: 2026-05-11
license: MIT
tags:
  - attack.stealth
  - attack.t1027.005

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains:
      - '/Applications/'
      - '/usr/local/bin/'

  condition: selection

falsepositives:
  - Normal application auto-update mechanisms replacing binaries, since detecting repeated hash mutation of a security tool binary requires hash-diffing capability not present in unified log file_change events.

level: low

Related sub-techniques

Explore