MITRE ATT&CKsub-technique

T1070.004 File Deletion

Published 2020-01-31 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
ESXi, Linux, macOS, Windows
Version
2.0
Created
2020-01-31

Description

Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint. There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well. Examples of built-in Command and Scripting Interpreter functions include del on Windows, rm or unlink on Linux and macOS, and `rm` on ESXi.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1070 Indicator Removal technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (319)

  • G1059 NIMBUS MANTICORE group
  • S9063 DEEPROOT software (malware)
  • S9067 TWOSTROKE software (malware)
  • S9052 MiniFast software (malware)
  • S9053 MiniJunk software (malware)
  • S9051 The Gentlemen Ransomware software (malware)
  • S9050 Vidar software (malware)
  • S9046 IOControl software (malware)
  • S9043 Mini Shai-Hulud software (malware)
  • S9042 CanisterWorm software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0061 Operation Digital Eye campaign
  • C0060 Operation AkaiRyū campaign
  • G1054 MirrorFace group
  • S9020 LODEINFO software (malware)
  • S9021 DOWNIISSA software (malware)
  • S9024 SPAWNCHIMERA software (malware)
  • S9025 NOOPLDR software (malware)
  • S9015 BRICKSTORM software (malware)
  • S9019 PureCrypter software (malware)
  • S9012 TRAILBLAZE software (malware)
  • S9007 HTTPTroy software (malware)
  • G1052 Contagious Interview group
  • S1246 BeaverTail software (malware)
  • S1247 Embargo software (malware)
  • S1244 Medusa Ransomware software (malware)
  • G1051 Medusa Group group
  • S1242 Qilin software (malware)
  • S1239 TONESHELL software (malware)
  • C0056 RedPenguin campaign
Show all 319 ›

Referenced by Compliance · mitigates (1)

  • CIS-3.5 Securely Dispose of Data CIS Safeguard v8.1

References