Compliance Node Overview
MITRE ATT&CK T1027.005 (Indicator Removal from Tools) is an Enterprise Defense Evasion sub-technique of T1027 (Obfuscated Files or Information). Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems. A good example of this is when malware is detected with a file signature and quarantined by anti-virus software. Affected platforms: Linux, macOS, Windows. The Center for Threat-Informed Defense maps this technique to NIST SP 800-53 Rev 5 controls AC-03, CM-02, CM-06, CM-07, SI-02, SI-03, SI-04, SI-07.
Pillar: Cybersecurity · Authority: MITRE Corporation · Version: 1.0.0 · Last updated:
Primary source: https://attack.mitre.org/techniques/T1027/005/
SHA-256 integrity: a6e17208c4ff3d366a75e2bbaa1ce9e55882fd6e10dd40f452a8fdd077627ae8
Primary Citations — 6 traced to source
- MITRE ATT&CK Technique T1027.005: Indicator Removal from Tools (https://attack.mitre.org/techniques/T1027/005/)
- MITRE ATT&CK Tactic TA0005: Defense Evasion (https://attack.mitre.org/tactics/TA0005/)
+ 4 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.
Access