MITRE ATT&CKtechnique

T0872 Indicator Removal on Host

Published 2020-05-21 Modified 2026-10-13 Official page ↗
Domain
ics
Tactics
Evasion
Platforms
Embedded, Windows, Linux, Network Devices
Version
1.0
Created
2020-05-21

Description

Adversaries may attempt to remove indicators of their presence on a system in an effort to cover their tracks. In cases where an adversary may feel detection is imminent, they may try to overwrite, delete, or cover up changes they have made to the device.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (1)

  • M0922 Restrict File and Directory Permissions mitigation

Referenced by MITRE ATT&CK · uses (3)

  • C0030 Triton Safety Instrumented System Attack campaign
  • S0607 KillDisk software (malware)
  • S1009 Triton software (malware)