T1070.010sub-technique of T1070 Indicator Removal

Relocate Malware

Linux · macOS · Network Devices · Windowsnothing on this site yetT1070.010 on attack.mitre.org

Once a payload is delivered, adversaries may reproduce copies of the same malware on the victim system to remove evidence of their presence and/or avoid defenses. Copying malware payloads to new locations may also be combined with File Deletion to cleanup older artifacts. Relocating malware may be a part of many actions intended to evade defenses.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection of Malware Relocation via Suspicious File Movement

Detects the relocation of malicious executables via copy/move actions across suspicious folders (e.g., from Downloads to System32), followed by deletion of the original source or renaming to blend into legitimate binaries.
Detects binary movement or copying between untrusted and trusted paths (e.g., /tmp/ → /usr/bin/ or /etc/init.d/) that may indicate persistence attempts or cleanup of origin traces.
Detects movement of binaries to `~/Library/`, `/System/`, or app bundle locations, especially after initial execution or download from Safari or Mail.
Detects firmware or script relocation attempts (e.g., CLI-based `copy`, `move`, or `rename`) between temporary partitions and config startup folders on routers or switches.

the rest of T1070

T1070.003 Clear Command History · not covered yet
T1070.004 File Deletion · 6 on this site
T1070.005 Network Share Connection Removal · not covered yet
T1070.006 Timestomp · 3 on this site
T1070.007 Clear Network Connection History and Configurations · not covered yet
T1070.008 Clear Mailbox Data · not covered yet
T1070.009 Clear Persistence · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.