APT42G1044 ↗
Has cleared Chrome browser history.1
tfMITRE ATT&CK technique
Indicator Removal T1070
- Tactic
- Stealth
- Platforms
- Containers, ESXi, Linux, macOS, Network Devices, Office Suite, Windows
- Version
- 3.0
- Created
- 31 May 2017
- Last modified
- 12 May 2026
- Contributors
- Brad Geesaman, @bradgeesaman; Ed Williams, Trustwave, SpiderLabs; Blake Strom, Microsoft 365 Defender
Sub-techniques 889 rules across the family · 28 mapped directly to T1070 · 5 of 8 carry rules
Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.2
CampaignsTop 17%
Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.27
Tools & malwareTop 13%
Tools & malware87th percentile · 87% of ATT&CK techniques have this many tools implementing them or fewer.28
Detection rulesTop 10%
Detection rules90th percentile · 90% of ATT&CK techniques have this many detection rules written or fewer.Indicator Removal MITRE reference T1070
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
APT5G1023 ↗
Has used the THINBLOOD utility to clear SSL VPN log files located at /home/runtime/logs.12
Mustang PandaG0129 ↗
Has deleted registry keys that store data and maintained persistence.1
Lazarus GroupG0032 ↗
Has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.1
All 4 groups for this technique
2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
Cutting EdgeC0029 ↗
During Cutting Edge, threat actors cleared logs to remove traces of their activity and restored compromised systems to a clean state to bypass manufacturer mitigations for CVE-2023-46805 and CVE-2024-21887.12
SolarWinds CompromiseC0024 ↗
During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.1
All 2 campaigns for this technique
27 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
IronWindS9029 ↗
Has used a .NET DLL named "exit-DN4-core.dll" to terminate malicious processes running on victim's systems.1
BPFDoorS1161 ↗
Clears the file location /proc/<PID>/environ removing all environment variables for the process.1
DUSTTRAPS1159 ↗
Restores the .text section of compromised DLLs after malicious code is loaded into memory and before the file is closed.1
MultiLayer WiperS1135 ↗
Uses a batch script to clear file system cache memory via the ProcessIdleTasks export in advapi32.dll as an anti-analysis and anti-forensics technique.1
IPsec HelperS1132 ↗
Can delete various registry keys related to its execution and use.1
SardonicS1085 ↗
Has the ability to delete created WMI objects to evade detections.1
All 27 software entries for this technique · 6 newest in this preview
Offense vs defense T1070
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 2Sigma rules (cumulative) · 20Splunk ESCU (cumulative) · 8
first rule: 2019 Q1 · 2 of 2 campaigns plottedIndicator Removal detection strategy DET0184
MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Indicator Removal Across Platforms
6 platforms
AN0520 · Windows
Monitors sequences involving deletion/modification of logs, registry keys, scheduled tasks, or prefetch files following suspicious process activity or elevated access escalation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | WinEventLog:Security | EventCode=1102 |
| File DeletionDC0040 | WinEventLog:Sysmon | EventCode=23 |
| Windows Registry Key ModificationDC0063 | WinEventLog:Sysmon | EventCode=13, 14 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TimeWindow | Correlate indicator removal within X mins after persistence/setup activities |
| TargetFilePathPattern | Customize detection to log file paths or common registry hives |
AN0521 · Linux
Detects deletion or overwriting of bash history, syslog, audit logs, and .ssh metadata following privilege elevation or suspicious process spawning.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | linux:cli | cleared or truncated .bash_history |
| File DeletionDC0040 | auditd:SYSCALL | unlink, rename, open |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredPaths | Adjust based on syslog/auditd file paths (/var/log/messages, /var/log/audit/audit.log) |
| UserContext | Scope to root/sudo usage or anomalous user behavior |
AN0522 · macOS
Detects clearing of unified logs, deletion of plist files tied to persistence, and manipulation of Terminal history after initial execution.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Application Log ContentDC0038 | macos:unifiedlog | log stream cleared or truncated |
| File DeletionDC0040 | fs:fsusage | unlink, fs_delete |
| File ModificationDC0061 | macos:osquery | File modifications in ~/Library/Preferences/ |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PlistTargetPaths | Define which plist paths relate to LaunchAgents or LaunchDaemons |
| ExecutionChainDepth | Allow tuning for multi-process persistence chains |
AN0523 · Containers
Monitors tampering with audit logs, volumes, or mounted storage often used for side-channel logging (e.g., /var/log inside containers) post-compromise.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File DeletionDC0040 | docker:daemon | container file operations |
| File MetadataDC0059 | ebpf:syscalls | Unexpected container volume unmount + file deletion |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| LogMountPaths | Tune based on how logs are exported (bind-mount, overlay) |
| ContainerLabelScope | Limit detection to suspicious containers or runtime classes |
AN0524 · ESXi
Tracks suspicious use of ESXi shell commands or PowerCLI to delete logs, rotate system files, or tamper with hostd/vpxa history.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File DeletionDC0040 | esxi:hostd | rm, clearlogs, logrotate |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| LogSourceType | Tune per vCenter, vSphere, ESXi CLI telemetry collection |
| LogPathPattern | Target specific high-value log paths (e.g., /var/log/hostd.log) |
AN0525 · Office Suite
Detects deletion or hiding of security-related mail rules, audit mailboxes, or calendar/log sync artifacts indicative of tampering post-intrusion.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Scheduled Job ModificationDC0012 | m365:exchange | Remove-InboxRule, Clear-Mailbox |
| Application Log ContentDC0038 | m365:unified | PurgeAuditLogs, Remove-MailboxAuditLog |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetMailboxScope | Limit by VIP mailboxes or external-facing users |
| AuditLogDepth | Tune for log deletion following lateral movement |
Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.
Remote Data StorageM1029
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.
Tests2Executorscmd 1 · PowerShell 1Need elevation1 of 2Have prerequisites0Have cleanup2Platformswindows
Tests from Atomic Red Team (MIT licence) · technique definition