Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1070 | Indicator Removal |
Comments
Intel Threat Detection Technology (TDT), combined with CrowdStrike Falcon Accelerated Memory Scanning (CAMS), strengthens cybersecurity defenses by enabling faster, real-time detection of Indicator Removal attacks. This integrated solution enhances CrowdStrike Falcon capabilities, improving its ability to detect and mitigate cyber threats earlier in the kill chain while minimizing system performance impact.
Indicator Removal attacks involve adversaries attempting to erase or alter system logs, forensic artifacts, or other indicators of compromise (IOCs) to evade detection. By removing these telltale signs, attackers aim to avoid triggering security alerts and delay detection, allowing them to maintain persistent access to systems. Intel TDT plays a critical role in identifying these evasive techniques by providing deep, real-time telemetry on program execution, memory access, and control flow. This telemetry allows security teams to detect abnormal behaviors, such as unauthorized manipulation of system logs or tampering with file systems, which are indicative of efforts to remove attack indicators.
In addition, CAMS offloads memory scanning tasks from the CPU to the Intel Integrated GPU, ensuring faster and more efficient detection of malicious activities without sacrificing system performance. CAMS helps identify suspicious actions, such as attempts to alter or delete logs, modify file system attributes, or hide evidence of compromise in memory.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1070.004 | File Deletion | 1 |