T1070 Indicator Removal | DetectionCode

About this technique

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.

Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion.

These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.

Detection rules85

Rules on DetectionCode tagged with T1070 or one of its sub-techniques.

Sigma51

Rule	Level	Log source	Technique
Cisco Clear Logs	high	cisco / NULL	T1070.003
Clearing Windows Console History	high	windows / ps_script	T1070 T1070.003
Disable of ETW Trace - Powershell	high	windows / ps_script	T1070
Disable Powershell Command History	high	windows / ps_script	T1070.003
ETW Trace Evasion Activity	high	windows / process_creation	T1070
Exchange PowerShell Cmdlet History Deleted	high	windows / file_delete	T1070
File Creation Date Changed to Another Year	high	windows / file_change	T1070.006
Fsutil Suspicious Invocation	high	windows / process_creation	T1070
Linux Command History Tampering	high	linux / NULL	T1070.003
Prefetch File Deleted	high	windows / file_delete	T1070.004
Remove Exported Mailbox from Exchange Webserver	high	windows / NULL	T1070
RunMRU Registry Key Deletion	high	windows / process_creation	T1070.003
RunMRU Registry Key Deletion - Registry	high	windows / registry_delete	T1070.003
Shadow Copies Deletion Using Operating Systems Utilities	high	windows / process_creation	T1070
Suspicious Ping/Del Command Combination	high	windows / process_creation	T1070.004
Sysmon Driver Unloaded Via Fltmc.EXE	high	windows / process_creation	T1070
Terminal Server Client Connection History Cleared - Registry	high	windows / registry_delete	T1070
ADS Zone.Identifier Deleted By Uncommon Application	medium	windows / file_delete	T1070.004
Backup Catalog Deleted	medium	windows / NULL	T1070.004
Cisco File Deletion	medium	cisco / NULL	T1070.004
Clear PowerShell History - PowerShell	medium	windows / ps_script	T1070.003
Clear PowerShell History - PowerShell Module	medium	windows / ps_module	T1070.003
Disable Administrative Share Creation at Startup	medium	windows / registry_set	T1070.005
DLL Load By System Process From Suspicious Locations	medium	windows / image_load	T1070
EventLog EVTX File Deleted	medium	windows / file_delete	T1070
File Deleted Via Sysinternals SDelete	medium	windows / file_delete	T1070.004
File Time Attribute Change	medium	macos / process_creation	T1070.006
File Time Attribute Change - Linux	medium	linux / NULL	T1070.006
Filter Driver Unloaded Via Fltmc.EXE	medium	windows / process_creation	T1070
Greedy File Deletion Using Del	medium	windows / process_creation	T1070.004
IIS WebServer Access Logs Deleted	medium	windows / file_delete	T1070
IIS WebServer Log Deletion via CommandLine Utilities	medium	windows / process_creation	T1070
Kubernetes Events Deleted	medium	kubernetes / application	T1070
Potential Ransomware or Unauthorized MBR Tampering Via Bcdedit.EXE	medium	windows / process_creation	T1070
Potential Secure Deletion with SDelete	medium	windows / NULL	T1070.004
Potentially Suspicious Ping/Copy Command Combination	medium	windows / process_creation	T1070.004
PowerShell Console History Logs Deleted	medium	windows / file_delete	T1070
PowerShell Deleted Mounted Share	medium	windows / ps_script	T1070.005
Powershell Timestomp	medium	windows / ps_script	T1070.006
SES Identity Has Been Deleted	medium	aws / NULL	T1070
Suspicious IO.FileStream	medium	windows / ps_script	T1070.003
Tomcat WebServer Logs Deleted	medium	windows / file_delete	T1070
Touch Suspicious Service File	medium	linux / process_creation	T1070.006
Directory Removal Via Rmdir	low	windows / process_creation	T1070.004
File Deletion Via Del	low	windows / process_creation	T1070.004
Linux Package Uninstall	low	linux / process_creation	T1070
MaxMpxCt Registry Value Changed	low	windows / registry_set	T1070.005
TeamViewer Log File Deleted	low	windows / file_delete	T1070.004
Unauthorized System Time Modification	low	windows / NULL	T1070.006
Unmount Share Via Net.EXE	low	windows / process_creation	T1070.005
File Deletion	informational	linux / process_creation	T1070.004

Splunk34

Rule	Type	Risk	Data source	Technique
Cisco ASA - Logging Message Suppression	Anomaly	NULL	Cisco ASA Logs	T1070
Cisco ASA - User Account Deleted From Local Database	Anomaly	NULL	Cisco ASA Logs	T1070.008
Clear Unallocated Sector Using Cipher App	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1070.004
Create or delete windows shares using net exe	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1070.005
ESXi Audit Tampering	TTP	NULL	VMWare ESXi Syslog	T1070
ESXi System Clock Manipulation	TTP	NULL	VMWare ESXi Syslog	T1070.006
Fsutil Zeroing File	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1070
Linux Account Manipulation Of SSH Config and Keys	Anomaly	NULL	Sysmon for Linux EventID 11	T1070.004
Linux Deletion Of Cron Jobs	Anomaly	NULL	Sysmon for Linux EventID 11	T1070.004
Linux Deletion Of Init Daemon Script	TTP	NULL	Sysmon for Linux EventID 11	T1070.004
Linux Deletion Of Services	TTP	NULL	Sysmon for Linux EventID 11	T1070.004
Linux Deletion of SSL Certificate	Anomaly	NULL	Sysmon for Linux EventID 11	T1070.004
Linux High Frequency Of File Deletion In Boot Folder	TTP	NULL	Sysmon for Linux EventID 11	T1070.004
Linux High Frequency Of File Deletion In Etc Folder	Anomaly	NULL	Sysmon for Linux EventID 11	T1070.004
Linux Indicator Removal Clear Cache	TTP	NULL	Sysmon for Linux EventID 1	T1070
Linux Indicator Removal Service File Deletion	Anomaly	NULL	Sysmon for Linux EventID 1	T1070.004
MacOS Log Removal	TTP	NULL	Osquery Results	T1070
O365 Email Hard Delete Excessive Volume	Anomaly	NULL	Office 365 Universal Audit Log	T1070.008
O365 Email Password and Payroll Compromise Behavior	TTP	NULL	Office 365 Universal Audit Log, Office 365 Reporting Message Trace	T1070.008
O365 Email Receive and Hard Delete Takeover Behavior	Anomaly	NULL	Office 365 Universal Audit Log, Office 365 Reporting Message Trace	T1070.008
O365 Email Send and Hard Delete Exfiltration Behavior	Anomaly	NULL	Office 365 Universal Audit Log, Office 365 Reporting Message Trace	T1070.008
O365 Email Send and Hard Delete Suspicious Behavior	Anomaly	NULL	Office 365 Universal Audit Log	T1070.008
O365 Email Send Attachments Excessive Volume	Anomaly	NULL	Office 365 Universal Audit Log	T1070.008
Process Deleting Its Process File Path	TTP	NULL	Sysmon EventID 1	T1070
Recursive Delete of Directory In Batch CMD	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1070.004
Sdelete Application Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1070.004
USN Journal Deletion	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1070
Windows ConsoleHost History File Deletion	Anomaly	NULL	Sysmon EventID 23, Sysmon EventID 26	T1070.003
Windows Default Rdp File Deletion	Anomaly	NULL	Sysmon EventID 23, Sysmon EventID 26	T1070.004
Windows Indicator Removal Via Rmdir	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1070
Windows Powershell History File Deletion	Anomaly	NULL	Powershell Script Block Logging 4104	T1070.003
Windows Rdp AutomaticDestinations Deletion	Anomaly	NULL	Sysmon EventID 23, Sysmon EventID 26	T1070.004
Windows RDP Cache File Deletion	Anomaly	NULL	Sysmon EventID 23, Sysmon EventID 26	T1070.004
Windows RDP Server Registry Deletion	Anomaly	NULL	Sysmon EventID 12, Sysmon EventID 13	T1070.004

Sub-techniques8

ID	Name	Examples
T1070.003	Clear Command History	11
T1070.004	File Deletion	311
T1070.005	Network Share Connection Removal	5
T1070.006	Timestomp	58
T1070.007	Clear Network Connection History and Configurations	4
T1070.008	Clear Mailbox Data	5
T1070.009	Clear Persistence	15
T1070.010	Relocate Malware	1

Groups4

Software27

Show 3 more

SILENTTRINITY Stuxnet SUNBURST

Campaigns2

Cutting Edge SolarWinds Compromise

Procedure examples33

Groups4

Used by	Procedure example
GroupAPT42	APT42 has cleared Chrome browser history. Mandiant APT42-untangling
GroupAPT5	APT5 has used the THINBLOOD utility to clear SSL VPN log files located at `/home/runtime/logs`. Mandiant Pulse Secure Update May 2021 Mandiant Pulse Secure Zero-Day April 2021
GroupLazarus Group	Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked. Lazarus APT January 2022
GroupMustang Panda	Mustang Panda has deleted registry keys that store data and maintained persistence. Eset PlugX Korplug Mustang Panda March 2022

Software27

Used by	Procedure example
MalwareBankshot	Bankshot deletes all artifacts associated with the malware from the infected machine. US-CERT Bankshot Dec 2017
MalwareBlackEnergy	BlackEnergy has removed the watermark associated with enabling the `TESTSIGNING` boot configuration option by removing the relevant strings in the `user32.dll.mui` of the system. F-Secure BlackEnergy 2014
MalwareBPFDoor	BPFDoor clears the file location `/proc/<PID>/environ` removing all environment variables for the process. Sandfly BPFDoor 2022
ToolCSPY Downloader	CSPY Downloader has the ability to remove values it writes to the Registry. Cybereason Kimsuky November 2020
MalwareDarkWatchman	DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history. Prevailion DarkWatchman 2021
ToolDonut	Donut can erase file references to payloads in-memory after being reflectively loaded and executed. Donut Github
MalwareDUSTTRAP	DUSTTRAP restores the `.text` section of compromised DLLs after malicious code is loaded into memory and before the file is closed. Google Cloud APT41 2024
MalwareEVILNUM	EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack. Prevailion EvilNum May 2020

View all 27 software examples

Campaigns2

Used by	Procedure example
CampaignCutting Edge	During Cutting Edge, threat actors cleared logs to remove traces of their activity and restored compromised systems to a clean state to bypass manufacturer mitigations for CVE-2023-46805 and CVE-2024-21887. Mandiant Cutting Edge Part 2 January 2024 Volexity Ivanti Zero-Day Exploitation January 2024
CampaignSolarWinds Compromise	During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file. FireEye SUNBURST Backdoor December 2020