{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1070","id":"T1070","name":"Indicator Removal","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1070","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"8ea78b0602a621cb78c87496636429e630845596fecfd029b16ced9709325c83","description":"Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.\n\nArtifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion.\n\nThese actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1070","external_id":"T1070"}],"platforms":["Containers","ESXi","Linux","macOS","Network Devices","Office Suite","Windows"],"environments":["cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1070.003","id":"T1070.003","name":"Clear Command History","page":"techniques/enterprise/T1070.003/"},{"key":"enterprise/T1070.004","id":"T1070.004","name":"File Deletion","page":"techniques/enterprise/T1070.004/"},{"key":"enterprise/T1070.005","id":"T1070.005","name":"Network Share Connection Removal","page":"techniques/enterprise/T1070.005/"},{"key":"enterprise/T1070.006","id":"T1070.006","name":"Timestomp","page":"techniques/enterprise/T1070.006/"},{"key":"enterprise/T1070.007","id":"T1070.007","name":"Clear Network Connection History and Configurations","page":"techniques/enterprise/T1070.007/"},{"key":"enterprise/T1070.008","id":"T1070.008","name":"Clear Mailbox Data","page":"techniques/enterprise/T1070.008/"},{"key":"enterprise/T1070.009","id":"T1070.009","name":"Clear Persistence","page":"techniques/enterprise/T1070.009/"},{"key":"enterprise/T1070.010","id":"T1070.010","name":"Relocate Malware","page":"techniques/enterprise/T1070.010/"}],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0040","name":"File Deletion","page":"telemetry/DC0040/","kind":"attack_component","category":"Endpoint activity","description":"Deletion of a file, with path and responsible process where available.","collection_focus":"Prefer Sysmon FileDeleteDetected (26) when content retention is not needed; FileDelete (23) also archives files and requires a storage/privacy plan.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","archived"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0040","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"delete","archived":false}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0059","name":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component","category":"Host state and inventory","description":"File attributes such as path, size, timestamps, ownership and cryptographic hash.","collection_focus":"Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["path","size_bytes","sha256","owner_uid"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0012","name":"Scheduled Job Modification","page":"telemetry/DC0012/","kind":"attack_component","category":"Windows and directory audit","description":"Changes to an existing scheduled job, such as its action, trigger or principal.","collection_focus":"Enable Audit Other Object Access Events and compare updated task definitions; collect scheduler file/unit changes on non-Windows hosts.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["task_name","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0012","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","attribute":"schedule","before":"daily","after":"hourly"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0063","name":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component","category":"Endpoint activity","description":"Registry value changes or registry object renames.","collection_focus":"Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","Keep this Windows-specific source separate from other operating systems; there is no direct cross-platform event-ID equivalence."],"configuration_example":null,"required_fields":["registry_path","event_type","value_type","value"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1070","id":"T1070","name":"Indicator Removal","domain":"enterprise","platforms":["Containers","ESXi","Linux","macOS","Network Devices","Office Suite","Windows"],"environments":["cloud-hosted-endpoint","containers","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1070","technique_page":"techniques/enterprise/T1070/","page":"detections/enterprise/T1070/","status":"rule_source_available","counts":{"sigma":20,"atlas_basic":0,"atlas_anomaly":1,"strategies":1,"analytics":6,"live_validated":0},"sigma_rules":[{"id":"3132570d-cab2-4561-9ea6-1743644b2290","title":"Kubernetes Events Deleted","status":"test","level":"medium","logsource":{"category":"application","product":"kubernetes","service":"audit"},"data_path":"data/detection-rules/3132570d-cab2-4561-9ea6-1743644b2290.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_events_deleted.yml","author":"Leo Tsaousis (@laripping)","kind":"sigma"},{"id":"20f754db-d025-4a8f-9d74-e0037e999a9a","title":"SES Identity Has Been Deleted","status":"test","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/20f754db-d025-4a8f-9d74-e0037e999a9a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_delete_identity.yml","author":"Janantha Marasinghe","kind":"sigma"},{"id":"95d61234-7f56-465c-6f2d-b562c6fedbc4","title":"Linux Package Uninstall","status":"test","level":"low","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/95d61234-7f56-465c-6f2d-b562c6fedbc4.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_remove_package.yml","author":"Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"09570ae5-889e-43ea-aac0-0e1221fb3d95","title":"Remove Exported Mailbox from Exchange Webserver","status":"test","level":"high","logsource":{"service":"msexchange-management","product":"windows"},"data_path":"data/detection-rules/09570ae5-889e-43ea-aac0-0e1221fb3d95.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/msexchange/win_exchange_proxyshell_remove_mailbox_export.yml","author":"Christian Burkard (Nextron Systems)","kind":"sigma"},{"id":"63c779ba-f638-40a0-a593-ddd45e8b1ddc","title":"EventLog EVTX File Deleted","status":"test","level":"medium","logsource":{"category":"file_delete","product":"windows"},"data_path":"data/detection-rules/63c779ba-f638-40a0-a593-ddd45e8b1ddc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_delete/file_delete_win_delete_event_log_files.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"a55349d8-9588-4c5a-8e3b-1925fe2a4ffe","title":"Exchange PowerShell Cmdlet History Deleted","status":"test","level":"high","logsource":{"category":"file_delete","product":"windows"},"data_path":"data/detection-rules/a55349d8-9588-4c5a-8e3b-1925fe2a4ffe.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_delete/file_delete_win_delete_exchange_powershell_logs.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"3eb8c339-a765-48cc-a150-4364c04652bf","title":"IIS WebServer Access Logs Deleted","status":"test","level":"medium","logsource":{"category":"file_delete","product":"windows"},"data_path":"data/detection-rules/3eb8c339-a765-48cc-a150-4364c04652bf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_delete/file_delete_win_delete_iis_access_logs.yml","author":"Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"ff301988-c231-4bd0-834c-ac9d73b86586","title":"PowerShell Console History Logs Deleted","status":"test","level":"medium","logsource":{"category":"file_delete","product":"windows"},"data_path":"data/detection-rules/ff301988-c231-4bd0-834c-ac9d73b86586.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_delete/file_delete_win_delete_powershell_command_history.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"270185ff-5f50-4d6d-a27f-24c3b8c9fef8","title":"Tomcat WebServer Logs Deleted","status":"test","level":"medium","logsource":{"category":"file_delete","product":"windows"},"data_path":"data/detection-rules/270185ff-5f50-4d6d-a27f-24c3b8c9fef8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/file/file_delete/file_delete_win_delete_tomcat_logs.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c","title":"DLL Load By System Process From Suspicious Locations","status":"test","level":"medium","logsource":{"product":"windows","category":"image_load"},"data_path":"data/detection-rules/9e9a9002-56c4-40fd-9eff-e4b09bfa5f6c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/image_load/image_load_susp_dll_load_system_process.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"bde47d4b-9987-405c-94c7-b080410e8ea7","title":"Clearing Windows Console History","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/bde47d4b-9987-405c-94c7-b080410e8ea7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"115fdba9-f017-42e6-84cf-d5573bf2ddf8","title":"Disable of ETW Trace - Powershell","status":"test","level":"high","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/115fdba9-f017-42e6-84cf-d5573bf2ddf8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_etw_trace_evasion.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"c9fbe8e9-119d-40a6-9b59-dd58a5d84429","title":"Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c9fbe8e9-119d-40a6-9b59-dd58a5d84429.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_bcdedit_susp_execution.yml","author":"@neu5ron","kind":"sigma"},{"id":"4931188c-178e-4ee7-a348-39e8a7a56821","title":"Filter Driver Unloaded Via Fltmc.EXE","status":"test","level":"medium","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/4931188c-178e-4ee7-a348-39e8a7a56821.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"4d7cda18-1b12-4e52-b45c-d28653210df8","title":"Sysmon Driver Unloaded Via Fltmc.EXE","status":"test","level":"high","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/4d7cda18-1b12-4e52-b45c-d28653210df8.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_fltmc_unload_driver_sysmon.yml","author":"Kirill Kiryanov, oscd.community","kind":"sigma"},{"id":"add64136-62e5-48ea-807e-88638d02df1e","title":"Fsutil Suspicious Invocation","status":"stable","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/add64136-62e5-48ea-807e-88638d02df1e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_fsutil_usage.yml","author":"Ecco, E.M. Anhaus, oscd.community","kind":"sigma"},{"id":"0649be4a-aeb0-45b0-b89e-7f1668f6d9c0","title":"IIS WebServer Log Deletion via CommandLine Utilities","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0649be4a-aeb0-45b0-b89e-7f1668f6d9c0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_iis_logs_deletion.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"a238b5d0-ce2d-4414-a676-7a531b3d13d6","title":"ETW Trace Evasion Activity","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/a238b5d0-ce2d-4414-a676-7a531b3d13d6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_etw_trace_evasion.yml","author":"@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","kind":"sigma"},{"id":"c947b146-0abc-4c87-9c64-b17e9d7274a2","title":"Shadow Copies Deletion Using Operating Systems Utilities","status":"stable","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/c947b146-0abc-4c87-9c64-b17e9d7274a2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_shadow_copies_deletion.yml","author":"Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades)","kind":"sigma"},{"id":"07bdd2f5-9c58-4f38-aec8-e101bb79ef8d","title":"Terminal Server Client Connection History Cleared - Registry","status":"test","level":"high","logsource":{"category":"registry_delete","product":"windows"},"data_path":"data/detection-rules/07bdd2f5-9c58-4f38-aec8-e101bb79ef8d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_delete/registry_delete_mstsc_history_cleared.yml","author":"Christian Burkard (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[{"id":"atlas-anomaly-t1070-1","technique_id":"T1070","title":"File timestamps, metadata, logs, or indicators modified — T1070 Indicator Removal","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#indicator-removal","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":69,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L69","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"cc4f61d99b1949d247c264ebe73663272858b35108cb22bf577ec32afe905156","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"file or telemetry stream.","expected_behavior":"metadata follows causal ordering and log sources emit regularly.","deviation":"impossible timestamp relationships, sudden missing telemetry, or abrupt state change.","anomaly_types":[{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Drought or Silence Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#17-drought-or-silence-anomaly"},{"title":"Missing-Correspondence Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#92-missing-correspondence-anomaly"}],"log_sources":[{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Central Log Collector Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#147-central-log-collector-logs"}],"context_references":[{"title":"Play ransomware joint advisory — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/ic3-aa23-352a-play-ransomware.pdf"},{"title":"original source","url":"https://www.ic3.gov/CSA/2023/231218.pdf"}]}],"anomaly_types":[{"title":"Conditional Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#5-conditional-anomaly"},{"title":"Drought or Silence Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#17-drought-or-silence-anomaly"},{"title":"Missing-Correspondence Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#92-missing-correspondence-anomaly"}],"strategies":[{"id":"DET0184","name":"Behavioral Detection of Indicator Removal Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0184","stix_id":"x-mitre-detection-strategy--7225a3bd-f235-4c13-a236-3c6b9a3d445c","relationship_id":"relationship--9b0ed970-db3e-4239-92dc-51c509d6a9c6","description":"","analytics":[{"id":"AN0520","name":"Analytic 0520","guidance":"Monitors sequences involving deletion/modification of logs, registry keys, scheduled tasks, or prefetch files following suspicious process activity or elevated access escalation.","url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0520","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Correlate indicator removal within X mins after persistence/setup activities"},{"field":"TargetFilePathPattern","description":"Customize detection to log file paths or common registry hives"}],"log_sources":[{"component_id":"DC0040","component":"File Deletion","name":"WinEventLog:Sysmon","channel":"EventCode=23","platforms":["Windows"],"analytic_id":"AN0520","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0520","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0040/"},{"component_id":"DC0038","component":"Application Log Content","name":"WinEventLog:Security","channel":"EventCode=1102","platforms":["Windows"],"analytic_id":"AN0520","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0520","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0063","component":"Windows Registry Key Modification","name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","platforms":["Windows"],"analytic_id":"AN0520","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0520","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0063/"}]},{"id":"AN0521","name":"Analytic 0521","guidance":"Detects deletion or overwriting of bash history, syslog, audit logs, and .ssh metadata following privilege elevation or suspicious process spawning.","url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0521","platforms":["Linux"],"tuning":[{"field":"MonitoredPaths","description":"Adjust based on syslog/auditd file paths (/var/log/messages, /var/log/audit/audit.log)"},{"field":"UserContext","description":"Scope to root/sudo usage or anomalous user behavior"}],"log_sources":[{"component_id":"DC0040","component":"File Deletion","name":"auditd:SYSCALL","channel":"unlink, rename, open","platforms":["Linux"],"analytic_id":"AN0521","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0521","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0040/"},{"component_id":"DC0038","component":"Application Log Content","name":"linux:cli","channel":"cleared or truncated .bash_history","platforms":["Linux"],"analytic_id":"AN0521","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0521","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN0522","name":"Analytic 0522","guidance":"Detects clearing of unified logs, deletion of plist files tied to persistence, and manipulation of Terminal history after initial execution.","url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0522","platforms":["macOS"],"tuning":[{"field":"PlistTargetPaths","description":"Define which plist paths relate to LaunchAgents or LaunchDaemons"},{"field":"ExecutionChainDepth","description":"Allow tuning for multi-process persistence chains"}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"macos:unifiedlog","channel":"log stream cleared or truncated","platforms":["macOS"],"analytic_id":"AN0522","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0522","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0040","component":"File Deletion","name":"fs:fsusage","channel":"unlink, fs_delete","platforms":["macOS"],"analytic_id":"AN0522","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0522","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0040/"},{"component_id":"DC0061","component":"File Modification","name":"macos:osquery","channel":"File modifications in ~/Library/Preferences/","platforms":["macOS"],"analytic_id":"AN0522","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0522","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]},{"id":"AN0523","name":"Analytic 0523","guidance":"Monitors tampering with audit logs, volumes, or mounted storage often used for side-channel logging (e.g., /var/log inside containers) post-compromise.","url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0523","platforms":["Containers"],"tuning":[{"field":"LogMountPaths","description":"Tune based on how logs are exported (bind-mount, overlay)"},{"field":"ContainerLabelScope","description":"Limit detection to suspicious containers or runtime classes"}],"log_sources":[{"component_id":"DC0040","component":"File Deletion","name":"docker:daemon","channel":"container file operations","platforms":["Containers"],"analytic_id":"AN0523","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0523","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0040/"},{"component_id":"DC0059","component":"File Metadata","name":"ebpf:syscalls","channel":"Unexpected container volume unmount + file deletion","platforms":["Containers"],"analytic_id":"AN0523","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0523","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0059/"}]},{"id":"AN0524","name":"Analytic 0524","guidance":"Tracks suspicious use of ESXi shell commands or PowerCLI to delete logs, rotate system files, or tamper with hostd/vpxa history.","url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0524","platforms":["ESXi"],"tuning":[{"field":"LogSourceType","description":"Tune per vCenter, vSphere, ESXi CLI telemetry collection"},{"field":"LogPathPattern","description":"Target specific high-value log paths (e.g., /var/log/hostd.log)"}],"log_sources":[{"component_id":"DC0040","component":"File Deletion","name":"esxi:hostd","channel":"rm, clearlogs, logrotate","platforms":["ESXi"],"analytic_id":"AN0524","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0524","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0040/"}]},{"id":"AN0525","name":"Analytic 0525","guidance":"Detects deletion or hiding of security-related mail rules, audit mailboxes, or calendar/log sync artifacts indicative of tampering post-intrusion.","url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0525","platforms":["Office Suite"],"tuning":[{"field":"TargetMailboxScope","description":"Limit by VIP mailboxes or external-facing users"},{"field":"AuditLogDepth","description":"Tune for log deletion following lateral movement"}],"log_sources":[{"component_id":"DC0012","component":"Scheduled Job Modification","name":"m365:exchange","channel":"Remove-InboxRule, Clear-Mailbox","platforms":["Office Suite"],"analytic_id":"AN0525","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0525","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0012/"},{"component_id":"DC0038","component":"Application Log Content","name":"m365:unified","channel":"PurgeAuditLogs, Remove-MailboxAuditLog","platforms":["Office Suite"],"analytic_id":"AN0525","source_url":"https://attack.mitre.org/detectionstrategies/DET0184#AN0525","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0040","name":"File Deletion","tag":"File Deletion","page":"telemetry/DC0040/","kind":"attack_component"},{"id":"DC0059","name":"File Metadata","tag":"File Metadata","page":"telemetry/DC0059/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0012","name":"Scheduled Job Modification","tag":"Scheduled Job Modification","page":"telemetry/DC0012/","kind":"attack_component"},{"id":"DC0063","name":"Windows Registry Key Modification","tag":"Windows Registry Key Modification","page":"telemetry/DC0063/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0527","name":"CSPY Downloader","page":"tools/S0527/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0527","name":"CSPY Downloader","page":"tools/S0527/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0695","name":"Donut","page":"tools/S0695/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0089","name":"BlackEnergy","url":"https://attack.mitre.org/software/S0089","kind":"malware","description":"[BlackEnergy](https://attack.mitre.org/software/S0089) has removed the watermark associated with enabling the <code>TESTSIGNING</code> boot configuration option by removing the relevant strings in the <code>user32.dll.mui</code> of the system.(Citation: F-Secure BlackEnergy 2014)","relationship_id":"relationship--12c761e7-f026-4e14-80fb-da9f4cb0ca38","references":[{"source_name":"F-Secure BlackEnergy 2014","description":"F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.","url":"https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"}]},{"id":"S0229","name":"Orz","url":"https://attack.mitre.org/software/S0229","kind":"malware","description":"[Orz](https://attack.mitre.org/software/S0229) can overwrite Registry settings to reduce its visibility on the victim.(Citation: Proofpoint Leviathan Oct 2017)","relationship_id":"relationship--31501f0f-e5be-4980-a2f1-b241d68f654c","references":[{"source_name":"Proofpoint Leviathan Oct 2017","description":"Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"id":"S0239","name":"Bankshot","url":"https://attack.mitre.org/software/S0239","kind":"malware","description":"[Bankshot](https://attack.mitre.org/software/S0239) deletes all artifacts associated with the malware from the infected machine.(Citation: US-CERT Bankshot Dec 2017)","relationship_id":"relationship--df520c15-50fc-46cf-8559-368e88072aa7","references":[{"source_name":"US-CERT Bankshot Dec 2017","description":"US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) can clean saved cookies and logins from the web browser.(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--a9154086-7359-4e2b-b70f-edcde2d43a80","references":[{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0448","name":"Rising Sun","url":"https://attack.mitre.org/software/S0448","kind":"malware","description":"[Rising Sun](https://attack.mitre.org/software/S0448) can clear a memory blog in the process by overwriting it with junk bytes.(Citation: McAfee Sharpshooter December 2018)\t","relationship_id":"relationship--811ba10b-6fe7-40d9-ab98-70d4135ac7cf","references":[{"source_name":"McAfee Sharpshooter December 2018","description":"Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}]},{"id":"S0449","name":"Maze","url":"https://attack.mitre.org/software/S0449","kind":"malware","description":"[Maze](https://attack.mitre.org/software/S0449) has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.(Citation: McAfee Maze March 2020)\t","relationship_id":"relationship--cabbe975-9936-4a9a-8fae-a747b3dc7a9d","references":[{"source_name":"McAfee Maze March 2020","description":"Mundo, A. (2020, March 26). Ransomware Maze. Retrieved May 18, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-maze/"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) has a command to delete a Registry key it uses, <code>\\Software\\Microsoft\\Internet Explorer\\notes</code>.(Citation: FireEye Metamorfo Apr 2018)","relationship_id":"relationship--5246b52e-cb6c-43da-84e5-dff0172abaea","references":[{"source_name":"FireEye Metamorfo Apr 2018","description":"Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"}]},{"id":"S0461","name":"SDBbot","url":"https://attack.mitre.org/software/S0461","kind":"malware","description":"[SDBbot](https://attack.mitre.org/software/S0461) has the ability to clean up and remove data structures from a compromised host.(Citation: Proofpoint TA505 October 2019)","relationship_id":"relationship--08f4dfcb-c394-470d-851f-045bbc38cdb5","references":[{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0527","name":"CSPY Downloader","url":"https://attack.mitre.org/software/S0527","kind":"tool","description":"[CSPY Downloader](https://attack.mitre.org/software/S0527) has the ability to remove values it writes to the Registry.(Citation: Cybereason Kimsuky November 2020)","relationship_id":"relationship--df1cdf5d-aaca-4a6f-ac5f-2506df830f62","references":[{"source_name":"Cybereason Kimsuky November 2020","description":"Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) removed HTTP proxy registry values to clean up traces of execution.(Citation: Microsoft Deep Dive Solorigate January 2021)","relationship_id":"relationship--fed38133-26a9-44e3-b57d-9d415aaeaf84","references":[{"source_name":"Microsoft Deep Dive Solorigate January 2021","description":"MSTIC, CDOC, 365 Defender Research Team. (2021, January 20). Deep dive into the Solorigate second-stage activation: From SUNBURST to TEARDROP and Raindrop . Retrieved January 22, 2021.","url":"https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"}]},{"id":"S0568","name":"EVILNUM","url":"https://attack.mitre.org/software/S0568","kind":"malware","description":"[EVILNUM](https://attack.mitre.org/software/S0568) has a function called \"DeleteLeftovers\" to remove certain artifacts of the attack.(Citation: Prevailion EvilNum May 2020)","relationship_id":"relationship--2062ec61-e6b5-45dd-8d2d-71aa5aa1f6e8","references":[{"source_name":"Prevailion EvilNum May 2020","description":"Adamitis, D. (2020, May 6). Phantom in the Command Shell. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20221209052853/https://www.prevailion.com/phantom-in-the-command-shell-2/"}]},{"id":"S0589","name":"Sibot","url":"https://attack.mitre.org/software/S0589","kind":"malware","description":"[Sibot](https://attack.mitre.org/software/S0589) will delete an associated registry key if a certain server response is received.(Citation: MSTIC NOBELIUM Mar 2021)","relationship_id":"relationship--d8b95918-bf5b-455a-928c-1b69fe9c9703","references":[{"source_name":"MSTIC NOBELIUM Mar 2021","description":"Nafisi, R., Lelli, A. (2021, March 4). GoldMax, GoldFinder, and Sibot: Analyzing NOBELIUM’s layered persistence. Retrieved March 8, 2021.","url":"https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/"}]},{"id":"S0596","name":"ShadowPad","url":"https://attack.mitre.org/software/S0596","kind":"malware","description":"[ShadowPad](https://attack.mitre.org/software/S0596) has deleted arbitrary Registry values.(Citation: Kaspersky ShadowPad Aug 2017)","relationship_id":"relationship--0dff1232-e275-46bd-b893-3df8b5a6b0c2","references":[{"source_name":"Kaspersky ShadowPad Aug 2017","description":"Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2017/08/07172148/ShadowPad_technical_description_PDF.pdf"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) can delete OLE Automation and SQL stored procedures used to store malicious payloads.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--726e2014-a0d6-4ed3-959b-2ad647884f5c","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) can uninstall malicious components from the Registry, stop processes, and clear the browser history.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--f54e5455-c539-4bcb-9a06-92440314324f","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S0691","name":"Neoichor","url":"https://attack.mitre.org/software/S0691","kind":"malware","description":"[Neoichor](https://attack.mitre.org/software/S0691) can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\\Software\\Microsoft\\Internet Explorer\\Privacy` Registry key.(Citation: Microsoft NICKEL December 2021)\n\n","relationship_id":"relationship--fee1306e-0a56-40c0-b3ea-ff0697c464a4","references":[{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) can remove artifacts from the compromised host, including created Registry keys.(Citation: GitHub SILENTTRINITY Modules July 2019)","relationship_id":"relationship--2123bedd-f2b3-4856-9ee4-5d23aa9c8745","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0695","name":"Donut","url":"https://attack.mitre.org/software/S0695","kind":"tool","description":"[Donut](https://attack.mitre.org/software/S0695) can erase file references to payloads in-memory after being reflectively loaded and executed.(Citation: Donut Github)","relationship_id":"relationship--07f86f87-71bf-4f6b-b902-e6e4d912e2d6","references":[{"source_name":"Donut Github","description":"TheWover. (2019, May 9). donut. Retrieved March 25, 2022.","url":"https://github.com/TheWover/donut"}]},{"id":"S0696","name":"Flagpro","url":"https://attack.mitre.org/software/S0696","kind":"malware","description":"[Flagpro](https://attack.mitre.org/software/S0696) can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.(Citation: NTT Security Flagpro new December 2021)","relationship_id":"relationship--e2d28250-862e-4dd5-8712-aa6b6782b088","references":[{"source_name":"NTT Security Flagpro new December 2021","description":"Hada, H. (2021, December 28).  Flagpro The new malware used by BlackTech. Retrieved March 25, 2022.","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}]},{"id":"S0697","name":"HermeticWiper","url":"https://attack.mitre.org/software/S0697","kind":"malware","description":"[HermeticWiper](https://attack.mitre.org/software/S0697) can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.(Citation: Crowdstrike DriveSlayer February 2022)(Citation: ESET Hermetic Wizard March 2022)","relationship_id":"relationship--42d6cd7c-a512-4fb9-a625-d21152b60f22","references":[{"source_name":"ESET Hermetic Wizard March 2022","description":"ESET. (2022, March 1). IsaacWiper and HermeticWizard: New wiper and worm targetingUkraine. Retrieved April 10, 2022.","url":"https://www.welivesecurity.com/2022/03/01/isaacwiper-hermeticwizard-wiper-worm-targeting-ukraine"},{"source_name":"Crowdstrike DriveSlayer February 2022","description":"Thomas, W. et al. (2022, February 25). CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks. Retrieved March 25, 2022.","url":"https://www.crowdstrike.com/blog/how-crowdstrike-falcon-protects-against-wiper-malware-used-in-ukraine-attacks/"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) has the ability to clean traces of malware deployment.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--b26f9867-37f2-4b7f-9b87-26f2152191bc","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1085","name":"Sardonic","url":"https://attack.mitre.org/software/S1085","kind":"malware","description":"[Sardonic](https://attack.mitre.org/software/S1085) has the ability to delete created WMI objects to evade detections.(Citation: Bitdefender Sardonic Aug 2021)","relationship_id":"relationship--bb5486b6-f5b3-4a4c-9b88-d676011a4906","references":[{"source_name":"Bitdefender Sardonic Aug 2021","description":"Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}]},{"id":"S1132","name":"IPsec Helper","url":"https://attack.mitre.org/software/S1132","kind":"malware","description":"[IPsec Helper](https://attack.mitre.org/software/S1132) can delete various registry keys related to its execution and use.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--038940df-ae44-4ca6-a417-6e4aac6a2f56","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"id":"S1135","name":"MultiLayer Wiper","url":"https://attack.mitre.org/software/S1135","kind":"malware","description":"[MultiLayer Wiper](https://attack.mitre.org/software/S1135) uses a batch script to clear file system cache memory via the <code>ProcessIdleTasks</code> export in <code>advapi32.dll</code> as an anti-analysis and anti-forensics technique.(Citation: Unit42 Agrius 2023)","relationship_id":"relationship--27e8b9dc-9b72-4e69-b093-c80c81cf6d59","references":[{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) restores the `.text` section of compromised DLLs after malicious code is loaded into memory and before the file is closed.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--3a065510-e719-4048-aec2-99db1cae1f79","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1161","name":"BPFDoor","url":"https://attack.mitre.org/software/S1161","kind":"malware","description":"[BPFDoor](https://attack.mitre.org/software/S1161) clears the file location `/proc/<PID>/environ` removing all environment variables for the process.(Citation: Sandfly BPFDoor 2022) ","relationship_id":"relationship--0d76add8-c0f1-44e3-abf2-f6063c43a100","references":[{"source_name":"Sandfly BPFDoor 2022","description":"The Sandfly Security Team. (2022, May 11). BPFDoor - An Evasive Linux Backdoor Technical Analysis. Retrieved September 29, 2023.","url":"https://sandflysecurity.com/blog/bpfdoor-an-evasive-linux-backdoor-technical-analysis/"}]},{"id":"S9029","name":"IronWind","url":"https://attack.mitre.org/software/S9029","kind":"malware","description":"[IronWind](https://attack.mitre.org/software/S9029) has used a .NET DLL named \"exit-DN4-core.dll\" to terminate malicious processes running on victim's systems.(Citation: Check Point Wirte NOV 2024)","relationship_id":"relationship--e1947d14-2a8a-4f22-90dd-75a351c039bd","references":[{"source_name":"Check Point Wirte NOV 2024","description":"Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]}],"actors":[{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) has restored malicious [KernelCallbackTable](https://attack.mitre.org/techniques/T1574/013) code to its original state after the process execution flow has been hijacked.(Citation: Lazarus APT January 2022)","relationship_id":"relationship--bcee230a-c671-4c71-afbf-d6216aeee5b6","references":[{"source_name":"Lazarus APT January 2022","description":"Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has deleted registry keys that store data and maintained persistence.(Citation: Eset PlugX Korplug Mustang Panda March 2022)","relationship_id":"relationship--49697cc6-d5fe-4a93-afbc-7eb767056021","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}]},{"id":"G1023","name":"APT5","url":"https://attack.mitre.org/groups/G1023","kind":"intrusion-set","description":"[APT5](https://attack.mitre.org/groups/G1023) has used the THINBLOOD utility to clear SSL VPN log files located at `/home/runtime/logs`.(Citation: Mandiant Pulse Secure Zero-Day April 2021)(Citation: Mandiant Pulse Secure Update May 2021)","relationship_id":"relationship--a4d00569-50d8-4571-9ea8-3cafcfbfaacb","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","description":"Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"},{"source_name":"Mandiant Pulse Secure Update May 2021","description":"Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"id":"G1044","name":"APT42","url":"https://attack.mitre.org/groups/G1044","kind":"intrusion-set","description":"[APT42](https://attack.mitre.org/groups/G1044) has cleared Chrome browser history.(Citation: Mandiant APT42-untangling) ","relationship_id":"relationship--3022f4d3-c2b9-4937-96ae-f4d86ba89bb8","references":[{"source_name":"Mandiant APT42-untangling","description":"Rozmann, O., et al. (2024, May 1). Uncharmed: Untangling Iran's APT42 Operations. Retrieved October 9, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]}],"mitigations":[{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.","relationship_id":"relationship--6db4729b-596c-43c1-81f4-d374a2f2e06b","references":[]},{"id":"M1029","name":"Remote Data Storage","url":"https://attack.mitre.org/mitigations/M1029","kind":"course-of-action","description":"Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system. ","relationship_id":"relationship--60151204-5c0c-4d18-8582-4d0fad22ed08","references":[]},{"id":"M1041","name":"Encrypt Sensitive Information","url":"https://attack.mitre.org/mitigations/M1041","kind":"course-of-action","description":"Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.","relationship_id":"relationship--185c194a-5823-46e4-9719-9de48c3c1734","references":[]}],"candidates":[{"id":"96e86706-6afd-45b6-95d6-108d23eaf2e9","name":"Indicator Manipulation using FSUtil","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070/T1070.yaml","description":"Finds a file by user name (if Disk Quotas are enabled), queries allocated ranges for a file, sets a file's short name, sets a file's valid data length, sets zero data for a file, or creates a new file. Upon execution, no output\nwill be displayed. More information about fsutil can be found at https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file\n- https://tria.ge/230601-x8x6bsgb24/behavioral2\n","inputs":{"file_to_manipulate":{"description":"Path of file to manipulate","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\T1070-2.txt"},"file_data_length":{"description":"Data length to setzero","type":"integer","default":10}},"dependencies":[],"source_definition_sha256":"a83e6c9b47bd0db2cbd199be9411f58a535959ccad243a022e67b3a4528dac7c"},{"id":"b4115c7a-0e92-47f0-a61e-17e7218b2435","name":"Indicator Removal using FSUtil","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1070/T1070.yaml","description":"Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. Upon execution, no output\nwill be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn\n","inputs":{},"dependencies":[],"source_definition_sha256":"739e29350b2d2436268c44d06b5a2553f10190c4b9bdff8dcc054bf4227e4927"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1070":"/ttp-simulation/techniques/enterprise/T1070/","T1574.013":"/ttp-simulation/techniques/enterprise/T1574.013/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1070","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0040","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"delete","archived":false}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0059","collector":"illustrative-lab-collector","observation":{"path":"/opt/lab/demo.txt","size_bytes":64,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","owner_uid":1000}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0012","collector":"illustrative-lab-collector","observation":{"task_name":"LabDailyCheck","attribute":"schedule","before":"daily","after":"hourly"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0063","collector":"illustrative-lab-collector","observation":{"registry_path":"HKCU\\Software\\Lab\\Mode","event_type":"SetValue","value_type":"DWORD","value":1}}]}}