345. That's How Adversaries Remove Indicators from Compromised Systems
Hello everyone! In many cases adversaries remove artifacts from compromised systems, so today we'll look at a few examples of Indicator Removal: File Deletion (T1070.004) . And our example for today - 01flip ransomware . It has both Windows and Linux variants. Windows variant removes itself using the following command: ping 127.0.0.7 -n 5 > Nul & fsutil file setZeroData offset=0 length=4194303 ${self_name} > Nul & Del /f /q ${self_name} As you can see, it abuses fsutil to wipe the file. We can look for similar activity: event_type: "processcreatewin" AND proc_file_path: "fsutil.exe" AND cmdline: ("file" AND "setzerodata") Linux variant runs the following command: sleep 5 && dd if=/dev/urandom of=${self_name} bs=1M count=4 > /dev/null 2>&1 && rm ${self_name} > /dev/null 2>&1 Here the adversary abuses dd , and it's another hunting oportunity: event_type: "processcreatenix" AND p...