TA0005 · DEFENSE EVASION
Indicator Removal
Deleting logs, files, and shell history, and timestomping artefacts to break timeline reconstruction.
Detect it with
wevtutil cl, `history -c`, mass file deletion in temp; MFT timestamps that disagree with $FILE_NAME.
Why it matters on shift
Indicator Removal is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
10 sub-techniques
How it shows up in practice
- T1070.001
Clear Windows Event Logs
Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications.
- T1070.002
Clear Linux or Mac System Logs
Adversaries may clear system logs to hide evidence of an intrusion. macOS and Linux both keep track of system or user-initiated actions via system logs.
- T1070.003
Clear Command History
In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.
- T1070.004
File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
- T1070.005
Network Share Connection Removal
Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation. Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed.
- T1070.006
Timestomp
Adversaries may modify file time attributes to hide new files or changes to existing files.
- T1070.007
Clear Network Connection History and Configurations
Adversaries may clear or remove evidence of malicious network connections in order to clean up traces of their operations.
- T1070.008
Clear Mailbox Data
Adversaries may modify mail and mail application data to remove evidence of their activity. Email applications allow users and other programs to export and delete mailbox data via command line tools or use of APIs.
- T1070.009
Clear Persistence
Adversaries may clear artifacts associated with previously established persistence on a host system to remove evidence of their activity.
- T1070.010
Relocate Malware
Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses.
Kill-chain context