Procedure examples

J-magic can overwrite previously executed command line arguments.

Hildegard has used history -c to clear script shell logs.

Kobalos can remove all command history on compromised hosts.

During Operation Dream Job, Lazarus Group removed all previously delivered files from a compromised computer.

KV Botnet Activity removes on-disk copies of tools and other artifacts after it the primary botnet payload has been loaded into memory on the victim device.

During RedPenguin, UNC3886 used malware capaple of removing scripts after execution.

During Operation Honeybee, the threat actors used batch files that reduced their fingerprint on a compromised system by deleting malware-related files.

During the 2015 Ukraine Electric Power Attack, vba_macro.exe deletes itself after `FONTCACHE.DAT`, `rundll32.exe`, and the associated .lnk file is delivered.

During Cutting Edge, threat actors deleted `/tmp/test1.txt` on compromised Ivanti Connect Secure VPNs which was used to hold stolen configuration and cache files.

During Operation Digital Eye, threat actors deleted files delivered to compromised hosts, often named with the pattern do.* such as do.exe.

During the C0032 campaign, TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.

During the SolarWinds Compromise, APT29 routinely removed their tools, including custom backdoors, once remote access was achieved.

During Operation AkaiRyū, MirrorFace deleted delivered tools and files from compromised hosts.

ArcaneDoor included multiple instances of file deletion or removal during execution and other adversary actions.

APT41 DUST deleted various artifacts from victim systems following use.

During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\windows\temp\ & copy \\<IP ADDRESS>\c$\windows\system32\devmgr.dll \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\windows\temp\ & del \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1`.

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.

BlackByte deleted ransomware executables post-encryption.

APT3 has a tool that can delete files.

Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk. Kimsuky has deleted files using the `Remove-Item` PowerShell commandlet to remove traces of executed payloads. Kimsuky has also removed remnants of files used for delivery to include .log and .zip files.

Volt Typhoon has run `rd /S` to delete their working directories and deleted systeminfo.dat from `C:\Users\Public\Documentsfiles`.

Patchwork removed certain files and replaced them so they could not be retrieved.

APT41 deleted files from the system.

Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.

Evilnum has deleted files used during infection.

A menuPass macro deletes files after it has decoded and decompressed them.

APT32's macOS backdoor can receive a “delete” command.

FIN6 has removed files from victim machines.

Gamaredon Group tools can delete files used during an operation.

TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.

Sandworm Team has used backdoors that can delete files used in an attack from an infected system.

APT18 actors deleted tools and batch files from victim systems.

Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.

Rocke has deleted files on infected machines.

APT39 has used malware to delete files after they are deployed on a compromised host.

UNC3886 has used the the esxcli command line to remove files created by malicious vSphere Installation Bundles from disk.

Contagious Interview has configured malware to remove archives used in collection activities following successful exfiltration.

OilRig has deleted files associated with their payload after execution.

Tropic Trooper has deleted dropper files on an infected system using command scripts.

Aquatic Panda has deleted malicious executables from compromised machines.

The White Company has the ability to delete its malware entirely from the target system.

Malware used by Group5 is capable of remotely deleting files from victims.

RedCurl has deleted files after execution.

FIN5 uses SDelete to clean up the environment and attempt to prevent detection.

APT29 has used SDelete to remove artifacts from victim networks.

Chimera has performed file deletion to evade detection.

MirrorFace has deleted directories containing malware and archives with files collected from the victim environment.

Medusa Group has deleted previously installed tools.

The BRONZE BUTLER uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.

Ember Bear deletes files related to lateral movement to avoid detection.