Description
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.(Citation: Microsoft SDelete July 2016) Examples of built-in Command and Scripting Interpreter functions include del on Windows, rm or unlink on Linux and macOS, and rm on ESXi.
Platforms
Threat Groups (47)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also re... |
| G1043 | BlackByte | [BlackByte](https://attack.mitre.org/groups/G1043) deleted ransomware executables post-encryption.(Citation: Picus BlackByte 2022)(Citation: Symantec ... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has a tool that can delete files.(Citation: FireEye Clandestine Fox) |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has deleted the exfiltrated data on disk after transmission. [Kimsuky](https://attack.mitre.org/group... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has run `rd /S` to delete their working directories and deleted systeminfo.dat from `C:\Users\Pu... |
| G0040 | Patchwork | [Patchwork](https://attack.mitre.org/groups/G0040) removed certain files and replaced them so they could not be retrieved.(Citation: TrendMicro Patchw... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) deleted files from the system.(Citation: FireEye APT41 Aug 2019)(Citation: Rostovcev APT41 2021) |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has deleted many of its files used during operations as part of cleanup, including removing applica... |
| G0120 | Evilnum | [Evilnum](https://attack.mitre.org/groups/G0120) has deleted files used during infection.(Citation: ESET EvilNum July 2020) |
| G0045 | menuPass | A [menuPass](https://attack.mitre.org/groups/G0045) macro deletes files after it has decoded and decompressed them.(Citation: Accenture Hogfish April ... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050)'s macOS backdoor can receive a “delete” command.(Citation: ESET OceanLotus macOS April 2019) |
| G0037 | FIN6 | [FIN6](https://attack.mitre.org/groups/G0037) has removed files from victim machines.(Citation: FireEye FIN6 April 2016) |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) tools can delete files used during an operation.(Citation: TrendMicro Gamaredon April 2020)(C... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has used a payload that removes itself after running. [TeamTNT](https://attack.mitre.org/groups/G0139... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has used backdoors that can delete files used in an attack from an infected system.(Citation: E... |
| G0026 | APT18 | [APT18](https://attack.mitre.org/groups/G0026) actors deleted tools and batch files from victim systems.(Citation: Dell Lateral Movement) |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) will delete their tools and files, and kill processes after their objectives are reached.(Citat... |
| G0106 | Rocke | [Rocke](https://attack.mitre.org/groups/G0106) has deleted files on infected machines.(Citation: Anomali Rocke March 2019) |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) has used malware to delete files after they are deployed on a compromised host.(Citation: FBI FLASH APT... |
| G1048 | UNC3886 | [UNC3886](https://attack.mitre.org/groups/G1048) has used the the esxcli command line to remove files created by malicious vSphere Installation Bundle... |
Associated Software (251)
| ID | Name | Type | Context |
|---|---|---|---|
| S0139 | PowerDuke | Malware | [PowerDuke](https://attack.mitre.org/software/S0139) has a command to write random data across a file and delete it.(Citation: Volexity PowerDuke Nove... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) has deleted itself and associated artifacts from victim machines.(Citation: US-CERT BLINDINGCAN... |
| S0662 | RCSession | Malware | [RCSession](https://attack.mitre.org/software/S0662) can remove files from a targeted system.(Citation: Profero APT27 December 2020) |
| S1039 | Bumblebee | Malware | [Bumblebee](https://attack.mitre.org/software/S1039) can uninstall its loader through the use of a `Sdl` command.(Citation: Proofpoint Bumblebee April... |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has the ability to delete files and directories.(Citation: CISA BRICKSTORM UNC5221 AR25-338A Feb... |
| S0233 | MURKYTOP | Malware | [MURKYTOP](https://attack.mitre.org/software/S0233) has the capability to delete local files.(Citation: FireEye Periscope March 2018) |
| S0416 | RDFSNIFFER | Malware | [RDFSNIFFER](https://attack.mitre.org/software/S0416) has the capability of deleting local files.(Citation: FireEye FIN7 Oct 2019) |
| S1192 | NICECURL | Malware | [NICECURL](https://attack.mitre.org/software/S1192) has a function to remove artifacts.(Citation: Mandiant APT42-untangling) |
| S0238 | Proxysvc | Malware | [Proxysvc](https://attack.mitre.org/software/S0238) can delete files indicated by the attacker and remove itself from disk using a batch file.(Citatio... |
| S0353 | NOKKI | Malware | [NOKKI](https://attack.mitre.org/software/S0353) can delete files to cover tracks.(Citation: Unit 42 NOKKI Sept 2018) |
| S0093 | Backdoor.Oldrea | Malware | [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) contains a cleanup module that removes traces of itself from the victim.(Citation: Symantec... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) uses an RPC server that contains a routine for file deletion and also removes itself from the syste... |
| S1154 | VersaMem | Malware | [VersaMem](https://attack.mitre.org/software/S1154) deleted files related to initial installation such as temporary files related to the PID of the ma... |
| S0164 | TDTESS | Malware | [TDTESS](https://attack.mitre.org/software/S0164) creates then deletes log files during installation of itself as a service.(Citation: ClearSky Wilted... |
| S1105 | COATHANGER | Malware | [COATHANGER](https://attack.mitre.org/software/S1105) removes files from victim environments following use in multiple instances.(Citation: NCSC-NL CO... |
| S0151 | HALFBAKED | Malware | [HALFBAKED](https://attack.mitre.org/software/S0151) can delete a specified file.(Citation: FireEye FIN7 April 2017) |
| S0466 | WindTail | Malware | [WindTail](https://attack.mitre.org/software/S0466) has the ability to receive and execute a self-delete command.(Citation: objective-see windtail2 ja... |
| S0083 | Misdat | Malware | [Misdat](https://attack.mitre.org/software/S0083) is capable of deleting the backdoor file.(Citation: Cylance Dust Storm) |
| S0401 | Exaramel for Linux | Malware | [Exaramel for Linux](https://attack.mitre.org/software/S0401) can uninstall its persistence mechanism and delete its configuration file.(Citation: ANS... |
| S0271 | KEYMARBLE | Malware | [KEYMARBLE](https://attack.mitre.org/software/S0271) has the capability to delete files off the victim’s machine.(Citation: US-CERT KEYMARBLE Aug 2018... |
References
Frequently Asked Questions
What is T1070.004 (File Deletion)?
T1070.004 is a MITRE ATT&CK technique named 'File Deletion'. It belongs to the Stealth tactic(s). Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: [Ingress Tool Transfe...
How can T1070.004 be detected?
Detection of T1070.004 (File Deletion) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1070.004?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1070.004?
Known threat groups using T1070.004 include: APT38, BlackByte, APT3, Kimsuky, Volt Typhoon, Patchwork, APT41, Dragonfly.