T1070
Indicator Removal
Containers · ESXi · Linux · macOS · Network Devices · Office Suite · Windows11 pieces on this siteT1070 on attack.mitre.org
Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.
The evidence it leaves
Where the traces live, and what each source proves and does not.
systemd journal
utmp, wtmp and btmp
$UsnJrnl change journal
Recycle Bin ($I and $R)
$MFT and the timestamp pair
Microsoft Defender Antivirus logs
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: build a disk image, then take it apart
The first lab for a machine of your own. You create the evidence yourself, delete a file from it, and then recover the file you deleted, which is the only way to be certain the recovery worked.
Read
Analyses, case studies, guides, references and interview questions.
Evidence Gap Challenge No. 3: four people knew that password
An operational technology jump host, a shared engineering account, and a change nobody will own. Every log works, every timestamp is right, and attribution is still impossible. Work out what that costs, and what you would have needed to collect to make a name provable.
The operator set the clock, and set only one of them
Timestomping is a decision, not an accident, and the decision is visible. NTFS keeps eight timestamps per file and the ordinary Windows API writes four of them. What the other four say about the tool the operator chose, the checklist they were working from, and where they stopped.
Forensic timeline cheat sheet: which clock, whose time zone, and what each timestamp really records
A timeline is only as good as your understanding of what each timestamp means. The artifacts that carry time on Windows, what event each one actually records, the zone it is stored in, and the commands to build and cut a super timeline.
linux-triage.sh: a read-only first-hour collection script for Linux
One Bash file that collects processes, sockets, deleted-but-running binaries, logons, SSH keys, persistence and recent changes in order of volatility, using only what ships with a distribution. It writes text files and a SHA-256 manifest, and it is short enough to read before you run it.
how MITRE says to see it
Behavioral Detection of Indicator Removal Across Platforms
- Monitors sequences involving deletion/modification of logs, registry keys, scheduled tasks, or prefetch files following suspicious process activity or elevated access escalation.
- Detects deletion or overwriting of bash history, syslog, audit logs, and.ssh metadata following privilege elevation or suspicious process spawning.
- Detects clearing of unified logs, deletion of plist files tied to persistence, and manipulation of Terminal history after initial execution.
- Monitors tampering with audit logs, volumes, or mounted storage often used for side-channel logging (e.g., /var/log inside containers) post-compromise.
what reduces it
- M1029 Remote Data Storage. Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.
- M1022 Restrict File and Directory Permissions. Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.
- M1041 Encrypt Sensitive Information. Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.