Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.
Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion.
These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
During Cutting Edge, threat actors cleared logs to remove traces of their activity and restored compromised systems to a clean state to bypass manufacturer mitigations for CVE-2023-46805 and CVE-2024-21887.12
During the SolarWinds Compromise, APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.1
2019–2021
All 2 campaigns for this technique
27 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Uses a batch script to clear file system cache memory via the ProcessIdleTasks export in advapi32.dll as an anti-analysis and anti-forensics technique.1
MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Behavioral Detection of Indicator Removal Across Platforms
Enterprise
6 platforms
AN0520 · Windows
Monitors sequences involving deletion/modification of logs, registry keys, scheduled tasks, or prefetch files following suspicious process activity or elevated access escalation.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
PlistTargetPaths
Define which plist paths relate to LaunchAgents or LaunchDaemons
ExecutionChainDepth
Allow tuning for multi-process persistence chains
AN0523 · Containers
Monitors tampering with audit logs, volumes, or mounted storage often used for side-channel logging (e.g., /var/log inside containers) post-compromise.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.
Tests2Executorscommand_prompt 1 · powershell 1Need elevation1 of 2Have prerequisites0Have cleanup2Platformswindows
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Indicator Removal using FSUtil
windows
command_prompt
Required
—
Yes
Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. Upon execution, no output
will be displayed. More information about fsutil can be found at https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-usn
Attack Commandsrun with command_promptelevation required (root or admin)
fsutil usn deletejournal /D C:
Cleanup Commands
fsutil usn createjournal m=1000 a=100 c:
GUIDb4115c7a-0e92-47f0-a61e-17e7218b2435
02
Indicator Manipulation using FSUtil
windows
powershell
—
—
Yes
Finds a file by user name (if Disk Quotas are enabled), queries allocated ranges for a file, sets a file's short name, sets a file's valid data length, sets zero data for a file, or creates a new file. Upon execution, no output
will be displayed. More information about fsutil can be found at https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
- https://tria.ge/230601-x8x6bsgb24/behavioral2
Tim Rauch (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
2022-09-16
2023-02-15
3eb8c339-a765-48cc-a150-4364c04652bf
Detects attempts to delete Internet Information Services (IIS) log files via command line utilities, which is a common defense evasion technique used by attackers to cover their tracks. (...)
Tuan Le (NCSGroup), Nasreddine Bencherchali (Nextron Systems)
2023-03-09
—
95d61234-7f56-465c-6f2d-b562c6fedbc4
Splunk
Detects the deletion or modification of logs on MacOS systems by identifying execution of the rm command with command-line arguments referencing system.log or audit-related paths. (...)