MITRE ATT&CKtechnique

T1070 Indicator Removal

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Containers, ESXi, Linux, macOS, Network Devices, Office Suite, Windows
Version
3.0
Created
2017-05-31

Description

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion. These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · mitigates (3)

  • M1041 Encrypt Sensitive Information mitigation
  • M1022 Restrict File and Directory Permissions mitigation
  • M1029 Remote Data Storage mitigation

Referenced by MITRE ATT&CK · subtechnique of (8)

  • T1070.010 Relocate Malware sub-technique
  • T1070.009 Clear Persistence sub-technique
  • T1070.008 Clear Mailbox Data sub-technique
  • T1070.007 Clear Network Connection History and Configurations sub-technique
  • T1070.003 Clear Command History sub-technique
  • T1070.004 File Deletion sub-technique
  • T1070.005 Network Share Connection Removal sub-technique
  • T1070.006 Timestomp sub-technique

Referenced by MITRE ATT&CK · uses (33)

  • S9029 IronWind software (malware)
  • G1044 APT42 group
  • S1161 BPFDoor software (malware)
  • S1159 DUSTTRAP software (malware)
  • S1132 IPsec Helper software (malware)
  • S1135 MultiLayer Wiper software (malware)
  • C0029 Cutting Edge campaign
  • G1023 APT5 group
  • S1085 Sardonic software (malware)
  • C0024 SolarWinds Compromise campaign
  • S1044 FunnyDream software (malware)
  • S0695 Donut software (tool)
  • S0696 Flagpro software (malware)
  • S0697 HermeticWiper software (malware)
  • S0692 SILENTTRINITY software (tool)
  • S0691 Neoichor software (malware)
  • S0673 DarkWatchman software (malware)
  • G0129 Mustang Panda group
  • S0596 ShadowPad software (malware)
  • S0589 Sibot software (malware)
  • S0568 EVILNUM software (malware)
  • S0559 SUNBURST software (malware)
  • S0603 Stuxnet software (malware)
  • S0527 CSPY Downloader software (tool)
  • S0461 SDBbot software (malware)
  • S0455 Metamorfo software (malware)
  • S0449 Maze software (malware)
  • S0448 Rising Sun software (malware)
  • S0332 Remcos software (tool)
  • S0239 Bankshot software (malware)
Show all 33 ›

Referenced by CAPEC · att&ck technique (1)

  • CAPEC-268 Audit Log Manipulation attack pattern

Referenced by Compliance · mitigates (21)

  • CIS-3.4 Enforce Data Retention CIS Safeguard v8.1
  • NIST-AC-16 Security and Privacy Attributes NIST 800-53 control
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-18 Wireless Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-CA-7 Continuous Monitoring NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CP-6 Alternate Storage Site NIST 800-53 control
  • NIST-CP-7 Alternate Processing Site NIST 800-53 control
  • NIST-CP-9 System Backup NIST 800-53 control
  • NIST-SC-36 Distributed Processing and Storage NIST 800-53 control
  • NIST-SC-4 Information in Shared System Resources NIST 800-53 control
  • NIST-SI-12 Information Management and Retention NIST 800-53 control
  • NIST-SI-23 Information Fragmentation NIST 800-53 control
  • NIST-SI-3 Malicious Code Protection NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control