Indicator Removal
Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command...
BY SOURCE
PROCEDURES (29)
Auto-extracted: 10 detections for process creation monitoring
Auto-extracted: 9 detections for general monitoring
Auto-extracted: 3 detections for file monitoring
Auto-extracted: 2 detections for kubernetes
Auto-extracted: 2 detections for authentication monitoring
Auto-extracted: 2 detections for registry
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for driver
Auto-extracted: 2 detections for event log
Auto-extracted: 2 detections for tamper
Auto-extracted: 2 detections for kernel
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for encrypt
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for cloud monitoring
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for script execution monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for encrypt