CircleCI Atomic Red Team doc generator
1.6 KiB
T1070 - Indicator Removal on Host
Description from ATT&CK
Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as [Bash History](https://attack.mitre.org/techniques/T1552/003) and /var/log/*.These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.
Atomic Tests
Atomic Test #1 - Indicator Removal using FSUtil
Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. Upon execution, no output will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
Supported Platforms: Windows
auto_generated_guid: b4115c7a-0e92-47f0-a61e-17e7218b2435
Attack Commands: Run with command_prompt! Elevation Required (e.g. root or admin)
fsutil usn deletejournal /D C:
Cleanup Commands:
fsutil usn createjournal m=1000 a=100 c: