T1027.005: Indicator Removal from Tools
Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.
A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.
Analyst context for executives and security teams
Indicator Removal from Tools matters because it describes adversaries adapting their tooling after a defensive product detects or quarantines it. For leaders, the issue is not just one missed file signature; it is whether the organization can recognize when a previously blocked tool has been modified and reintroduced across Windows, Linux, or macOS environments.
Executive priority
Prioritize this as a resilience and detection-quality question: are security teams measuring whether malware or offensive tools return in altered form after quarantine or blocking? This affects incident response confidence, managed detection validation, and audit evidence for anti-malware and monitoring controls. The relationship context includes espionage groups, commercial/offensive tooling, malware families, and campaigns including the Triton Safety Instrumented System Attack, so organizations with high-value, managed service provider, telecom, energy, or safety-critical environments should ensure detections are not dependent only on brittle static indicators.
Technical view
This is a stealth sub-technique of T1027 Obfuscated Files or Information. MITRE provides no official detection text, so SOC and detection engineering should validate coverage around post-detection modification patterns rather than rely only on known hashes or file signatures. The related DET0189 detection strategy indicates a focus on post-AV evasion modification. Practical validation should include whether AV/EDR quarantine events can be correlated with later execution, transfer, or appearance of similar but not identical tools on Linux, macOS, and Windows systems.
Likely telemetry
- Anti-virus and endpoint protection detections, quarantine, restore, and remediation logs
- EDR file creation, modification, execution, and process lineage events
- File metadata and hash history for quarantined and subsequently observed binaries or scripts
- Security control verdict changes over time for the same or similar tooling
- Host inventory and software execution telemetry across Linux, macOS, and Windows
Detection direction
- Do not treat quarantine as closure; tune workflows to look for reintroduction of modified files after an initial detection.
- Validate whether detections use behavior, lineage, and context in addition to static indicators such as hashes or signatures.
- Correlate endpoint protection events with subsequent process execution and file-write activity on the same host or related hosts.
- Account for false positives from legitimate software updates, recompilation, packing, or administrative script changes.
- Use relationship context to test against relevant tool classes, including Cobalt Strike, PowerSploit, QakBot, SUNBURST, and other software linked by ATT&CK, without assuming those are present locally.
Mitigation priorities
- Ensure endpoint protection and EDR logging retains quarantine, detection reason, and file metadata long enough for incident review.
- Reduce dependence on single static indicators by combining signature-based prevention with behavior-based monitoring and response playbooks.
- During incidents, require responders to search for modified variants after a tool is blocked or quarantined.
- Maintain cross-platform coverage for Windows, Linux, and macOS where these platforms are in scope.
- Use threat intelligence relationships as prioritization input for testing, but validate against local telemetry and business-critical assets.
Analyst notes and limits
ATT&CK lists this as a stealth sub-technique affecting Linux, macOS, and Windows. The object is revoked from older T1066 into T1027.005, and it is associated with multiple groups, campaigns, and software entries, indicating broad relevance across tooling rather than a single actor pattern. The supplied object has no official MITRE detection text, so defensive recommendations are framed as validation directions rather than guaranteed analytics.
This take is based only on the supplied ATT&CK fields, external reference, and relationships. It does not establish current exploitation, local exposure, attribution, or existing detection coverage. Local endpoint telemetry, retention, tooling configuration, and incident history are required to determine actual risk and control effectiveness.
Indicator Removal from Tools
Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.
A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1027 | Obfuscated Files or Information | This object subtechnique of Obfuscated Files or Information. |
| Enterprise | T1066 | Indicator Removal from Tools | Indicator Removal from Tools revoked by this object. |
Groups, software, and campaigns
G1048: UNC3886
UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.[1][2]
G0040: Patchwork
Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.[1] [2][3][4]
G0009: Deep Panda
Deep Panda is a suspected Chinese threat group known to target many industries, including government, defense, financial, and telecommunications. [1] The intrusion into healthcare company Anthem has been attributed to Deep Panda. [2] This group is also known as Shell Crew, WebMasters, KungFu Kittens, and PinkPanther. [3] Deep Panda also appears to be known as Black Vine based on the attribution of both group names to the Anthem intrusion. [4] Some analysts track Deep Panda and APT19 as the same group, but it is unclear from open source information if the groups are the same. [5]
G0093: GALLIUM
GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. This group is particularly known for launching Operation Soft Cell, a long-term campaign targeting telecommunications providers.[1] Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.[1][2][3]
G0049: OilRig
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]
G0010: Turla
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]
G0022: APT3
APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security.[1][2] This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.[1][3] As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.[4]
S0237: GravityRAT
GravityRAT is a remote access tool (RAT) and has been in ongoing development since 2016. The actor behind the tool remains unknown, but two usernames have been recovered that link to the author, which are "TheMartian" and "The Invincible." According to the National Computer Emergency Response Team (CERT) of India, the malware has been identified in attacks against organization and entities in India. [1]
S0154: Cobalt Strike
Cobalt Strike is a commercial, full-featured, remote access tool that bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.[1]
In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz.[1]
S0194: PowerSploit
PowerSploit is an open source, offensive security framework comprised of PowerShell modules and scripts that perform a wide range of tasks related to penetration testing such as code execution, persistence, bypassing anti-virus, recon, and exfiltration. [1] [2] [3]
S0587: Penquin
S0650: QakBot
S0579: Waterbear
S0187: Daserf
S0559: SUNBURST
S0260: InvisiMole
InvisiMole is a modular spyware program that has been used by the InvisiMole Group since at least 2013. InvisiMole has two backdoor modules called RC2FM and RC2CL that are used to perform post-exploitation activities. It has been discovered on compromised victims in the Ukraine and Russia. Gamaredon Group infrastructure has been used to download and execute InvisiMole against a small number of victims.[1][2]
C0014: Operation Wocao
Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]
Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]
C0030: Triton Safety Instrumented System Attack
Triton Safety Instrumented System Attack was a campaign employed by TEMP.Veles which leveraged the Triton malware framework against a petrochemical organization.[1] The malware and techniques used within this campaign targeted specific Triconex Safety Controllers within the environment.[2] The incident was eventually discovered due to a safety trip that occurred as a result of an issue in the malware.[3]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.0 | Current bundle | 7059de82f686… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack T1027.005Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.