T1070.004sub-technique of T1070 Indicator Removal
File Deletion
ESXi · Linux · macOS · Windows6 pieces on this siteT1070.004 on attack.mitre.org
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
The evidence it leaves
Where the traces live, and what each source proves and does not.
$UsnJrnl change journal
Recycle Bin ($I and $R)
Microsoft Defender Antivirus logs
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: build a disk image, then take it apart
The first lab for a machine of your own. You create the evidence yourself, delete a file from it, and then recover the file you deleted, which is the only way to be certain the recovery worked.
Read
Analyses, case studies, guides, references and interview questions.
Forensic timeline cheat sheet: which clock, whose time zone, and what each timestamp really records
A timeline is only as good as your understanding of what each timestamp means. The artifacts that carry time on Windows, what event each one actually records, the zone it is stored in, and the commands to build and cut a super timeline.
linux-triage.sh: a read-only first-hour collection script for Linux
One Bash file that collects processes, sockets, deleted-but-running binaries, logons, SSH keys, persistence and recent changes in order of volatility, using only what ships with a distribution. It writes text files and a SHA-256 manifest, and it is short enough to read before you run it.
how MITRE says to see it
Behavioral Detection of Malicious File Deletion
- Detects adversary behavior deleting artifacts (e.g., dropped payloads, evidence files) using native or external utilities (e.g., del, erase, SDelete). Detects deletion events correlated with unusual process lineage or timing post-execution.
- Detects deletion of suspicious files (e.g., payloads, temp exes, scripts) via `rm`, `unlink`, or secure deletion tools like `shred`, especially when performed by unexpected users or shortly after execution.
- Detects removal of adversary artifacts via `rm`, `unlink`, or secure tools, with focus on shell sessions, temp files, and modified LaunchAgents or system directories.
- Detects manual or scripted removal of logs, artifacts, or malware droppings via `rm` or PowerCLI in ESXi shell. Focus on deletions from /tmp/, /var/core/, or /scratch.