Disables service(s)

Modifies file permissions

Stops running service(s)

Indicator Removal: Clear Persistence

Clear artifacts associated with previously established persistence like scheduletasks on a host.

Indicator Removal: File Deletion

Adversaries may delete files left behind by the actions of their intrusion activity.

System Binary Proxy Execution: Verclsid

Adversaries may abuse Verclsid to proxy execution of malicious code.

Writes to the Master Boot Record (MBR)

Bootkits write to the MBR to gain persistence at a level below the operating system.