Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015)
Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1564 | Hide Artifacts |
Comments
Intel Threat Detection Technology (TDT), combined with CrowdStrike Falcon Accelerated Memory Scanning (CAMS), strengthens cybersecurity defenses by enabling faster, real-time protection of Hide Artifacts attacks. This integrated solution enhances CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, all while minimizing system performance impact.
Hide artifacts techniques involve adversaries attempting to conceal the traces of their malicious activities, such as files, processes, or registry keys, to evade detection by security tools. These attacks are designed to obscure the presence of malware, backdoors, or unauthorized actions, making it difficult for traditional security defenses to identify and respond. Intel TDT plays a crucial role by providing real-time telemetry on program execution, memory access, and control flow, enabling the rapid detection of abnormal behaviors that may indicate attempts to hide malicious artifacts or modify system data.
Additionally, CAMS offloads the performance-intensive task of memory scanning from the CPU to the Intel Integrated GPU, ensuring faster and more efficient detection of malicious activity without degrading system performance. CAMS helps identify suspicious behaviors, such as unauthorized modifications or attempts to conceal malicious processes, files, or other artifacts, providing proactive defense against these stealthy attack techniques.
References
|
| intel-tdt | Intel Threat Detection Technology | CrowdStrike AMS | T1564 | Hide Artifacts |
Comments
Intel Threat Detection Technology (TDT), combined with CrowdStrike Falcon Accelerated Memory Scanning (CAMS), strengthens cybersecurity defenses by enabling faster, real-time detection of Hide Artifacts attacks. This integrated solution enhances CrowdStrike Falcon, improving its ability to detect and mitigate cyber threats earlier in the kill chain, all while minimizing system performance impact.
Hide artifacts techniques involve adversaries attempting to conceal the traces of their malicious activities, such as files, processes, or registry keys, to evade detection by security tools. These attacks are designed to obscure the presence of malware, backdoors, or unauthorized actions, making it difficult for traditional security defenses to identify and respond. Intel TDT plays a crucial role by providing real-time telemetry on program execution, memory access, and control flow, enabling the rapid detection of abnormal behaviors that may indicate attempts to hide malicious artifacts or modify system data.
Additionally, CAMS offloads the performance-intensive task of memory scanning from the CPU to the Intel Integrated GPU, ensuring faster and more efficient detection of malicious activity without degrading system performance. CAMS helps identify suspicious behaviors, such as unauthorized modifications or attempts to conceal malicious processes, files, or other artifacts, providing proactive defense against these stealthy attack techniques.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1564.006 | Run Virtual Instance | 1 |
| T1564.004 | NTFS File Attributes | 2 |