Remove Tool Indicators and Signatures

MITRE ATT&CK T1027.005 describes an adversary modifying a tool to remove indicators after it has been detected, quarantined, or otherwise disrupted, then reusing the changed tool. A changed hash alone does not establish maliciousness or successful evasion; detection depends on correlating prior alerts with replacement files and subsequent behavior.