1200KM / simulation
Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be…
Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.
Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion.
These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.
Official technique definition · Open in the interactive matrix
Related pages are navigation context. Their tools, rules and lab results are not automatically inherited.
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
DC0038 collection page — Select the application event family required by the detection and document its native schema before normalization.
Required normalized fields: service, action, actor, record_count, result.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0038",
"collector": "illustrative-lab-collector",
"observation": {
"service": "lab-portal",
"action": "export_requested",
"actor": "lab-reader",
"record_count": 3,
"result": "authorized"
}
}Visibility limits: Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.
DC0040 collection page — Prefer Sysmon FileDeleteDetected (26) when content retention is not needed; FileDelete (23) also archives files and requires a storage/privacy plan.
Required normalized fields: process_id, path, action, archived.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0040",
"collector": "illustrative-lab-collector",
"observation": {
"process_id": 4200,
"path": "C:\\Lab\\demo.txt",
"action": "delete",
"archived": false
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0059 collection page — Collect scoped file inventory/FIM metadata with hash algorithm and observation time; preserve original timestamps separately from collector time.
Required normalized fields: path, size_bytes, sha256, owner_uid.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0059",
"collector": "illustrative-lab-collector",
"observation": {
"path": "/opt/lab/demo.txt",
"size_bytes": 64,
"sha256": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"owner_uid": 1000
}
}Visibility limits: Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.
DC0061 collection page — Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.
Required normalized fields: path, attribute, before, after.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0061",
"collector": "illustrative-lab-collector",
"observation": {
"path": "C:\\Lab\\demo.txt",
"attribute": "content_hash",
"before": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"after": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0012 collection page — Enable Audit Other Object Access Events and compare updated task definitions; collect scheduler file/unit changes on non-Windows hosts.
Required normalized fields: task_name, attribute, before, after.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0012",
"collector": "illustrative-lab-collector",
"observation": {
"task_name": "LabDailyCheck",
"attribute": "schedule",
"before": "daily",
"after": "hourly"
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
DC0063 collection page — Use RegistryEvent 13 for value-set and 14 for rename; compare against intended policy and keep original type/value where available.
Required normalized fields: registry_path, event_type, value_type, value.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0063",
"collector": "illustrative-lab-collector",
"observation": {
"registry_path": "HKCU\\Software\\Lab\\Mode",
"event_type": "SetValue",
"value_type": "DWORD",
"value": 1
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
Open the dedicated detection workspace · Existing query engineering
Monitors sequences involving deletion/modification of logs, registry keys, scheduled tasks, or prefetch files following suspicious process activity or elevated access escalation.
Platforms: Windows.
Detects deletion or overwriting of bash history, syslog, audit logs, and .ssh metadata following privilege elevation or suspicious process spawning.
Platforms: Linux.
Detects clearing of unified logs, deletion of plist files tied to persistence, and manipulation of Terminal history after initial execution.
Platforms: macOS.
Monitors tampering with audit logs, volumes, or mounted storage often used for side-channel logging (e.g., /var/log inside containers) post-compromise.
Platforms: Containers.
Tracks suspicious use of ESXi shell commands or PowerCLI to delete logs, rotate system files, or tamper with hostd/vpxa history.
Platforms: ESXi.
Detects deletion or hiding of security-related mail rules, audit mailboxes, or calendar/log sync artifacts indicative of tampering post-intrusion.
Platforms: Office Suite.
20 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.
Conditional Anomaly · Drought or Silence Anomaly · Missing-Correspondence Anomaly
Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.
Anomaly Detection Atlas · Baseline, validation and blind spots
These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.
BlackEnergy has removed the watermark associated with enabling the <code>TESTSIGNING</code> boot configuration option by removing the relevant strings in the <code>user32.dll.mui</code> of the system.[F-Secure BlackEnergy 2014]
Exact relationship: relationship--12c761e7-f026-4e14-80fb-da9f4cb0ca38Orz can overwrite Registry settings to reduce its visibility on the victim.[Proofpoint Leviathan Oct 2017]
Exact relationship: relationship--31501f0f-e5be-4980-a2f1-b241d68f654cBankshot deletes all artifacts associated with the malware from the infected machine.[US-CERT Bankshot Dec 2017]
Exact relationship: relationship--df520c15-50fc-46cf-8559-368e88072aa7Remcos can clean saved cookies and logins from the web browser.[Fortinet Remcos Campaign NOV 2024]
Exact relationship: relationship--a9154086-7359-4e2b-b70f-edcde2d43a80Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.[McAfee Sharpshooter December 2018]
Exact relationship: relationship--811ba10b-6fe7-40d9-ab98-70d4135ac7cfMaze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.[McAfee Maze March 2020]
Exact relationship: relationship--cabbe975-9936-4a9a-8fae-a747b3dc7a9dMetamorfo has a command to delete a Registry key it uses, <code>\Software\Microsoft\Internet Explorer\notes</code>.[FireEye Metamorfo Apr 2018]
Exact relationship: relationship--5246b52e-cb6c-43da-84e5-dff0172abaeaSDBbot has the ability to clean up and remove data structures from a compromised host.[Proofpoint TA505 October 2019]
Exact relationship: relationship--08f4dfcb-c394-470d-851f-045bbc38cdb5CSPY Downloader has the ability to remove values it writes to the Registry.[Cybereason Kimsuky November 2020]
Exact relationship: relationship--df1cdf5d-aaca-4a6f-ac5f-2506df830f62SUNBURST removed HTTP proxy registry values to clean up traces of execution.[Microsoft Deep Dive Solorigate January 2021]
Exact relationship: relationship--fed38133-26a9-44e3-b57d-9d415aaeaf84EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.[Prevailion EvilNum May 2020]
Exact relationship: relationship--2062ec61-e6b5-45dd-8d2d-71aa5aa1f6e8Sibot will delete an associated registry key if a certain server response is received.[MSTIC NOBELIUM Mar 2021]
Exact relationship: relationship--d8b95918-bf5b-455a-928c-1b69fe9c9703ShadowPad has deleted arbitrary Registry values.[Kaspersky ShadowPad Aug 2017]
Exact relationship: relationship--0dff1232-e275-46bd-b893-3df8b5a6b0c2Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.[Nicolas Falliere, Liam O Murchu, Eric Chien February 2011]
Exact relationship: relationship--726e2014-a0d6-4ed3-959b-2ad647884f5cDarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.[Prevailion DarkWatchman 2021]
Exact relationship: relationship--f54e5455-c539-4bcb-9a06-92440314324fNeoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy` Registry key.[Microsoft NICKEL December 2021]
Exact relationship: relationship--fee1306e-0a56-40c0-b3ea-ff0697c464a4SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.[GitHub SILENTTRINITY Modules July 2019]
Exact relationship: relationship--2123bedd-f2b3-4856-9ee4-5d23aa9c8745Donut can erase file references to payloads in-memory after being reflectively loaded and executed.[Donut Github]
Exact relationship: relationship--07f86f87-71bf-4f6b-b902-e6e4d912e2d6Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.[NTT Security Flagpro new December 2021]
Exact relationship: relationship--e2d28250-862e-4dd5-8712-aa6b6782b088HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.[Crowdstrike DriveSlayer February 2022][ESET Hermetic Wizard March 2022]
Exact relationship: relationship--42d6cd7c-a512-4fb9-a625-d21152b60f22FunnyDream has the ability to clean traces of malware deployment.[Bitdefender FunnyDream Campaign November 2020]
Exact relationship: relationship--b26f9867-37f2-4b7f-9b87-26f2152191bcSardonic has the ability to delete created WMI objects to evade detections.[Bitdefender Sardonic Aug 2021]
Exact relationship: relationship--bb5486b6-f5b3-4a4c-9b88-d676011a4906IPsec Helper can delete various registry keys related to its execution and use.[SentinelOne Agrius 2021]
Exact relationship: relationship--038940df-ae44-4ca6-a417-6e4aac6a2f56MultiLayer Wiper uses a batch script to clear file system cache memory via the <code>ProcessIdleTasks</code> export in <code>advapi32.dll</code> as an anti-analysis and anti-forensics technique.[Unit42 Agrius 2023]
Exact relationship: relationship--27e8b9dc-9b72-4e69-b093-c80c81cf6d59DUSTTRAP restores the `.text` section of compromised DLLs after malicious code is loaded into memory and before the file is closed.[Google Cloud APT41 2024]
Exact relationship: relationship--3a065510-e719-4048-aec2-99db1cae1f79BPFDoor clears the file location `/proc/<PID>/environ` removing all environment variables for the process.[Sandfly BPFDoor 2022]
Exact relationship: relationship--0d76add8-c0f1-44e3-abf2-f6063c43a100IronWind has used a .NET DLL named "exit-DN4-core.dll" to terminate malicious processes running on victim's systems.[Check Point Wirte NOV 2024]
Exact relationship: relationship--e1947d14-2a8a-4f22-90dd-75a351c039bdAtomic evidence: 2 compatible documented candidates. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
Finds a file by user name (if Disk Quotas are enabled), queries allocated ranges for a file, sets a file's short name, sets a file's valid data length, sets zero data for a file, or creates a new file. Upon execution, no output
will be displayed. More information about fsutil can be found at https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
- https://tria.ge/230601-x8x6bsgb24/behavioral2
Pinned Atomic procedure · 96e86706-6afd-45b6-95d6-108d23eaf2e9 · windows · powershell.
Elevation: not declared required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
file_to_manipulate: Path of file to manipulate (type path; source default PathToAtomicsFolder\..\ExternalPayloads\T1070-2.txt)file_data_length: Data length to setzero (type integer; source default 10)Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. Upon execution, no output
will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
Pinned Atomic procedure · b4115c7a-0e92-47f0-a61e-17e7218b2435 · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
No input arguments declared.
Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Download synthetic collection fixture (JSON) · Download the complete engineering workbook
This fixture exercises the listed collection fields. It does not reproduce Indicator Removal, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.
Not run in this browser. No network scan or attack command is executed by this control.
All-page audit and evidence inventory · This page’s machine-readable workbook
Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.
Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.
Source procedure platform / method / executor tags:
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.
Telemetry contracts · Maintained query examples · Validation and blind spots
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.