T1070: Indicator Removal

Description

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.

Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion.

These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.

Platforms

Sub-Techniques (8)

Mitigations (3)

Threat Groups (4)

ID	Group	Context
G0129	Mustang Panda	[Mustang Panda](https://attack.mitre.org/groups/G0129) has deleted registry keys that store data and maintained persistence.(Citation: Eset PlugX Korp...
G1044	APT42	[APT42](https://attack.mitre.org/groups/G1044) has cleared Chrome browser history.(Citation: Mandiant APT42-untangling)
G1023	APT5	[APT5](https://attack.mitre.org/groups/G1023) has used the THINBLOOD utility to clear SSL VPN log files located at `/home/runtime/logs`.(Citation: Man...
G0032	Lazarus Group	[Lazarus Group](https://attack.mitre.org/groups/G0032) has restored malicious [KernelCallbackTable](https://attack.mitre.org/techniques/T1574/013) cod...

Associated Software (27)

ID	Name	Type	Context
S0229	Orz	Malware	[Orz](https://attack.mitre.org/software/S0229) can overwrite Registry settings to reduce its visibility on the victim.(Citation: Proofpoint Leviathan ...
S0603	Stuxnet	Malware	[Stuxnet](https://attack.mitre.org/software/S0603) can delete OLE Automation and SQL stored procedures used to store malicious payloads.(Citation: Nic...
S9029	IronWind	Malware	[IronWind](https://attack.mitre.org/software/S9029) has used a .NET DLL named "exit-DN4-core.dll" to terminate malicious processes running on victim's...
S1085	Sardonic	Malware	[Sardonic](https://attack.mitre.org/software/S1085) has the ability to delete created WMI objects to evade detections.(Citation: Bitdefender Sardonic ...
S0239	Bankshot	Malware	[Bankshot](https://attack.mitre.org/software/S0239) deletes all artifacts associated with the malware from the infected machine.(Citation: US-CERT Ban...
S1159	DUSTTRAP	Malware	[DUSTTRAP](https://attack.mitre.org/software/S1159) restores the `.text` section of compromised DLLs after malicious code is loaded into memory and be...
S0691	Neoichor	Malware	[Neoichor](https://attack.mitre.org/software/S0691) can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` v...
S0089	BlackEnergy	Malware	[BlackEnergy](https://attack.mitre.org/software/S0089) has removed the watermark associated with enabling the <code>TESTSIGNING</code> boot configurat...
S0448	Rising Sun	Malware	[Rising Sun](https://attack.mitre.org/software/S0448) can clear a memory blog in the process by overwriting it with junk bytes.(Citation: McAfee Sharp...
S0696	Flagpro	Malware	[Flagpro](https://attack.mitre.org/software/S0696) can close specific Windows Security and Internet Explorer dialog boxes to mask external connections...
S0673	DarkWatchman	Malware	[DarkWatchman](https://attack.mitre.org/software/S0673) can uninstall malicious components from the Registry, stop processes, and clear the browser hi...
S1135	MultiLayer Wiper	Malware	[MultiLayer Wiper](https://attack.mitre.org/software/S1135) uses a batch script to clear file system cache memory via the <code>ProcessIdleTasks</code...
S0568	EVILNUM	Malware	[EVILNUM](https://attack.mitre.org/software/S0568) has a function called "DeleteLeftovers" to remove certain artifacts of the attack.(Citation: Prevai...
S0455	Metamorfo	Malware	[Metamorfo](https://attack.mitre.org/software/S0455) has a command to delete a Registry key it uses, <code>\Software\Microsoft\Internet Explorer\notes...
S1161	BPFDoor	Malware	[BPFDoor](https://attack.mitre.org/software/S1161) clears the file location `/proc/<PID>/environ` removing all environment variables for the process.(...
S0461	SDBbot	Malware	[SDBbot](https://attack.mitre.org/software/S0461) has the ability to clean up and remove data structures from a compromised host.(Citation: Proofpoint...
S0589	Sibot	Malware	[Sibot](https://attack.mitre.org/software/S0589) will delete an associated registry key if a certain server response is received.(Citation: MSTIC NOBE...
S0697	HermeticWiper	Malware	[HermeticWiper](https://attack.mitre.org/software/S0697) can disable pop-up information about folders and desktop items and delete Registry keys to hi...
S0559	SUNBURST	Malware	[SUNBURST](https://attack.mitre.org/software/S0559) removed HTTP proxy registry values to clean up traces of execution.(Citation: Microsoft Deep Dive ...
S1132	IPsec Helper	Malware	[IPsec Helper](https://attack.mitre.org/software/S1132) can delete various registry keys related to its execution and use.(Citation: SentinelOne Agriu...

Frequently Asked Questions

What is T1070 (Indicator Removal)?

T1070 is a MITRE ATT&CK technique named 'Indicator Removal'. It belongs to the Stealth tactic(s). Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may t...

How can T1070 be detected?

Detection of T1070 (Indicator Removal) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1070?

There are 3 documented mitigations for T1070. Key mitigations include: Remote Data Storage, Restrict File and Directory Permissions, Encrypt Sensitive Information.

Which threat groups use T1070?

Known threat groups using T1070 include: Mustang Panda, APT42, APT5, Lazarus Group.