1200KM / detection
T1027.005 Indicator Removal from Tools — Detection Rules
Detection workspace for T1027.005 Indicator Removal from Tools: 4 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Potential Secure Deletion with SDelete · test · medium · {"product":"windows","service":"security"}
- HackTool - CrackMapExec PowerShell Obfuscation · test · high · {"category":"process_creation","product":"windows"}
- PUA - DefenderCheck Execution · test · high · {"category":"process_creation","product":"windows"}
- PUA - Potential PE Metadata Tamper Using Rcedit · test · medium · {"category":"process_creation","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0189 Detection Strategy for Indicator Removal from Tools - Post-AV Evasion Modification
AN0540 Analytic 0540
Detection of known tools or malware flagged by antivirus, followed by a near-term drop of a similar binary with modified signature and resumed activity (execution, C2, or persistence).
AN0541 Analytic 0541
Detection of anti-malware quarantining or flagging a tool, followed by a new binary written to disk with a similar function or name and a resumed process chain.
AN0542 Analytic 0542
Detection of XProtect or AV quarantining a known tool, followed by modification (file size, hash, string) and subsequent re-execution by the same or related user.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.