Skip to content

Indicator Removal from Tools

Subtechnique · ATTACK:enterprise:T1027.005

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1027.005",
  "title": "Indicator Removal from Tools",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1027/005",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--b0533c6e-8fea-4788-874f-b799cacc4b92",
  "external_id": "T1027.005",
  "domain": "enterprise",
  "created": "2020-03-19T21:27:32.820Z",
  "modified": "2026-09-11T19:58:00.789Z",
  "version": "2.1",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "Files and Antivirus Detection",
      "url": "https://www.opswat.com/docs/mdcore/knowledge-base/why-can-small-file-changes-bypass-the-antivirus-detection-"
    }
  ]
}

Explicit source assertions (20)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0057843b-ebe3-43f9-9ae0-90c8bdc802fc

Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023

ATTACK:enterprise:S0237 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--03e6e755-12a2-4261-b95d-caea6b2bf051

Talos GravityRAT

ATTACK:enterprise:T1027.005 → subtechnique-of → ATTACK:enterprise:T1027

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a7810c5-850a-41e9-9d44-cbbdeebd8044

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10b3228c-b96b-4a34-8da8-4d1fd3fa37d0

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0040 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1a273c5c-b362-4126-b684-7751b85cbf5c

TrendMicro Patchwork Dec 2017

ATTACK:enterprise:S0194 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26eca19b-1c55-49b5-8a07-a4131c577874

GitHub PowerSploit May 2012 · PowerSploit Documentation

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d68b3eb-9689-4a6d-b6ab-367fbc5ddade

Symantec Black Vine

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--919f6143-eb8c-48cd-8741-118040c372ab

Cybereason Soft Cell June 2019

ATTACK:enterprise:S0587 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab009520-dffe-4494-9468-0189060cca01

Leonardo Turla Penquin May 2020

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b71e1e23-5fc2-46af-ab0b-afa442c24b66

FoxIT Wocao December 2019

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b82cbc8a-72b9-4f2b-a978-88b066a73cfb

Crowdstrike Qakbot October 2020 · Cyberint Qakbot May 2021

ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c902196d-7a86-4235-b2a8-bf380a0cab3c

FireEye TEMP.Veles 2018

ATTACK:enterprise:S0579 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e041070a-ff38-47ee-aebd-8d1bc714231e

Trend Micro Waterbear December 2019

ATTACK:enterprise:S0187 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e79c65f4-f9d2-4568-96a4-b6e00d3bad71

Trend Micro Daserf Nov 2017

ATTACK:enterprise:S0559 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e88a2959-311f-40c9-adc9-895f38bb1dd7

CrowdStrike SUNSPOT Implant January 2021

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0894796-a4ed-48c4-94fc-7fc42175416d

ESET InvisiMole June 2020

ATTACK:enterprise:S9050 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7d6b2a3-8f82-4c06-8be0-a7131ccac4bc

QuorumCyber_Vidar_March2023

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb6ffb5c-5405-4515-a120-7a34414933ea

Palo Alto OilRig April 2017 · Unit42 OilRig Nov 2018

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe9c9381-99d7-4798-ab41-3e5cdbda5e21

ESET Gazer Aug 2017

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--febbf503-d7e5-4896-90b9-35b6a811b19b

APT3 Adversary Emulation Plan

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.