CmdID / Techniques / T1027
T1027.005 Obfuscated Files or Information: Indicator Removal from Tools
Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. MITRE ATT&CK
3 Sigma rules T1027.005 on attack.mitre.org
Part of
T1027Obfuscated Files or Information
Sigma rules tagged with it
Command lines CmdID reads as it
Encrypt an exported credential object on the page for Export-Clixml
$Credxmlpath = Join-Path (Split-Path $PROFILE) TestScript.ps1.credential
$Credential | Export-Clixml $Credxmlpath
$Credxmlpath = Join-Path (Split-Path $PROFILE) TestScript.ps1.credential
$Credential = Import-Clixml $CredxmlpathIdentifyNormalizing input on the page for Read-Host
$prompt = @(
'List the cities you want weather information for.'
'When specifying multiple cities, separate them with a semi-colon, like:'
"'New York; Osan; Koforidua'"
) -join ' '
$cities = Read-Host $prompt
"Input cities string: nt'$cities'"
$splitCities = $cities -split ';'
"Split cities array:"
$splitCities | ForEach-Object -Process { "t'$_'" }
$normalizedCities = $splitCities | ForEach-Object -Process { $_.Trim() }
"Normalized split cities array:"
$normalizedCities | ForEach-Object -Process { "t'$_'" }IdentifyAn example is here when CmdID’s reading of it names T1027.005: a Sigma rule it trips is tagged with it, or its abuse is documented as it.