T1562.006 Indicator Blocking
An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirecting3 or even disabling host-based sensors, such as Event Tracing for Windows (ETW)4, by tampering settings that control the collection and flow of event telemetry.5 These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as PowerShell or Windows Management Instrumentation.
For example, adversaries may modify the
File value in
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security to hide their malicious actions in a new or different .evtx log file. This action does not require a system reboot and takes effect immediately.1
ETW interruption can be achieved multiple ways, however most directly by defining conditions using the PowerShell
Set-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations.
In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis. This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products.
In Linux environments, adversaries may disable or reconfigure log processing tools such as syslog or nxlog to inhibit detection and monitoring capabilities to facilitate follow on behaviors 2.
|T1562.001, T1562.002, T1562.003, T1562.004, T1562.006, T1562.007, T1562.008, T1562.009, T1562.010, T1562.011
|Linux, Windows, macOS
|19 March 2020
|12 April 2023
|Brute Ratel C4
|Brute Ratel C4 has the ability to hide memory artifacts and to patch Event Tracing for Windows (ETW) and the Anti Malware Scan Interface (AMSI).87
|Ebury can hook logging functions so that nothing from the backdoor gets sent to the logging facility.14
|HermeticWiper has the ability to set the
HKLM:\SYSTEM\\CurrentControlSet\\Control\\CrashControl\CrashDumpEnabled Registry key to
0 in order to disable crash dumps.91011
|Waterbear can hook the
GetExtendedTcpTable APIs called by the process of a security product to hide PIDs and TCP records from detection.13
|Woody RAT has suppressed all error reporting by calling
SetErrorMode with 0x8007 as a parameter.12
|Restrict File and Directory Permissions
|Ensure event tracers/forwarders 6, firewall policies, and other associated mechanisms are secured with appropriate permissions and access controls.
|Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, etc.) as well as applying appropriate change management to firewall rules and other related system configurations.
|User Account Management
|Ensure event tracers/forwarders 6, firewall policies, and other associated mechanisms are secured with appropriate permissions and access controls and cannot be manipulated by user accounts.
|Windows Registry Key Modification