THREATNOIR
Subscribe
MITRE ATT&CK · T1070

Indicator Removal

MITRE · cited in 7 of our lessons

Explanation

What attackers do. Attackers delete or change evidence of their activity, such as event logs, command histories, files, network connection records or email, to avoid detection and slow investigation. This serves the Defence Evasion tactic.

How to defend. Forward logs to a central system as they are created so local deletion does not remove them, and restrict who can clear logs. Monitor log clearing and audit policy changes, and protect logging agents from tampering. Retain logs for long enough to support investigation, and alert when an expected source stops sending data.

Signs to look for. Look for security log cleared events, gaps in log sequences, deleted shell histories, file timestamps that do not match surrounding activity, and stopped logging services. A common gap is storing logs only on the host being attacked.

Open the technique on MITRE ATT&CK
The official text
Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion. These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.