[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1070":3},{"item":4,"lessons":18,"controls":48,"related":77},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1070","T1070","Indicator Removal",7,"MITRE","**What attackers do.** Attackers delete or change evidence of their activity, such as event logs, command histories, files, network connection records or email, to avoid detection and slow investigation. This serves the Defence Evasion tactic.\n\n**How to defend.** Forward logs to a central system as they are created so local deletion does not remove them, and restrict who can clear logs. Monitor log clearing and audit policy changes, and protect logging agents from tampering. Retain logs for long enough to support investigation, and alert when an expected source stops sending data.\n\n**Signs to look for.** Look for security log cleared events, gaps in log sequences, deleted shell histories, file timestamps that do not match surrounding activity, and stopped logging services. A common gap is storing logs only on the host being attacked.","Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.\n\nArtifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion.\n\nThese actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1070\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44],{"slug":21,"title":22,"published_at":23},"chinese-apt-exploits-beyondtrust-zero-day-to-harvest-credentials-and-exfiltrate-data","Chinese APT Exploits BeyondTrust Zero-Day to Harvest Credentials and Exfiltrate Data","2026-10-16T12:20:53.961+00:00",{"slug":25,"title":26,"published_at":27},"north-korean-apt-deploys-stealthy-linux-toolkit-targeting-south-korean-industries","North Korean APT Deploys Stealthy Linux Toolkit Targeting South Korean Industries","2026-09-07T14:21:39.152+00:00",{"slug":29,"title":30,"published_at":31},"trojanized-haproxy-builds-used-to-hide-north-korean-backdoor","Trojanized HAProxy Builds Used to Hide North Korean Backdoor","2026-09-04T16:20:41.753+00:00",{"slug":33,"title":34,"published_at":35},"incomplete-telemetry-blinds-ai-security-tools-to-sophisticated-attacks","Incomplete Telemetry Blinds AI Security Tools to Sophisticated Attacks","2026-08-27T12:22:34.283+00:00",{"slug":37,"title":38,"published_at":39},"ai-email-assistants-can-be-weaponized-to-hijack-accounts-and-commit-fraud","AI Email Assistants Can Be Weaponized to Hijack Accounts and Commit Fraud","2026-08-04T14:20:22.591+00:00",{"slug":41,"title":42,"published_at":43},"unpatched-pan-os-flaw-opens-door-to-qilin-ransomware-via-vpn-bypass","Unpatched PAN-OS Flaw Opens Door to Qilin Ransomware via VPN Bypass","2026-07-21T16:22:01.799+00:00",{"slug":45,"title":46,"published_at":47},"cisco-sd-wan-zero-day-exploited-for-root-access-before-public-disclosure","Cisco SD-WAN Zero-Day Exploited for Root Access Before Public Disclosure","2026-06-25T06:20:23.206+00:00",[49,54,59,64,68,72],{"slug":50,"name":51,"problem":52,"stories":53},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":55,"name":56,"problem":57,"stories":58},"patch-management","Automated patch management","Known holes get closed in days, not months.",3,{"slug":60,"name":61,"problem":62,"stories":63},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",2,{"slug":65,"name":66,"problem":67,"stories":63},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",{"slug":69,"name":70,"problem":71,"stories":63},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":73,"name":74,"problem":75,"stories":76},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,[78,82,87,93,97,101,105,109],{"family":79,"item":80,"code":81,"title":81,"together":53},"itil","overview","ITIL",{"family":83,"item":84,"code":85,"title":86,"together":53},"cis","13","Control 13","Network Monitoring and Defense",{"family":88,"item":89,"code":90,"title":91,"together":92},"nist-800-53","au-9","AU-9","Protection of Audit Information",4,{"family":83,"item":94,"code":95,"title":96,"together":92},"8","Control 8","Audit Log Management",{"family":88,"item":98,"code":99,"title":100,"together":58},"sc-7","SC-7","Boundary Protection",{"family":83,"item":102,"code":103,"title":104,"together":58},"7","Control 7","Continuous Vulnerability Management",{"family":83,"item":106,"code":107,"title":108,"together":58},"12","Control 12","Network Infrastructure Management",{"family":88,"item":110,"code":111,"title":112,"together":58},"si-7","SI-7","Software, Firmware, and Information Integrity"]