Threat Actors may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed. They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.