ATT&CK technique
View on MITRE ATT&CK →
T1027.005
Indicator Removal from Tools
Stealth
6 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| splunk | Powershell Creating Thread Mutex | production | 2026-05-13 |
| splunk | Powershell Enable SMB1Protocol Feature | production | 2026-05-13 |
| sigma | Potential Secure Deletion with SDelete | test | 2024-12-13 |
| sigma | PUA - Potential PE Metadata Tamper Using Rcedit | test | 2023-03-05 |
| sigma | HackTool - CrackMapExec PowerShell Obfuscation | test | 2023-02-21 |
| sigma | PUA - DefenderCheck Execution | test | 2023-02-04 |