Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1070.004

T1070.004File Deletion

T1070.004 — File Deletion is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 29 detection use cases covering it and 19 threat-intel articles citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
29Use cases
19Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1070 · Indicator Removal

Use cases covering this technique (29)

Clear Unallocated Sector Using Cipher App ESCU actions · alerting P Linux Account Manipulation Of SSH Config and Keys ESCU actions · hunting P Linux Deletion Of Cron Jobs ESCU actions · hunting P Linux Deletion Of Init Daemon Script ESCU actions · alerting P Linux Deletion Of Services ESCU actions · alerting P Linux Deletion of SSL Certificate ESCU actions · hunting P Linux High Frequency Of File Deletion In Boot Folder ESCU actions · alerting P Linux High Frequency Of File Deletion In Etc Folder ESCU actions · hunting P Linux Indicator Removal Service File Deletion ESCU actions · hunting P Recursive Delete of Directory In Batch CMD ESCU actions · alerting P Sdelete Application Execution ESCU actions · alerting P Windows Default Rdp File Deletion ESCU actions · hunting P Windows Rdp AutomaticDestinations Deletion ESCU actions · hunting P Windows RDP Cache File Deletion ESCU actions · hunting P Windows RDP Server Registry Deletion ESCU actions · hunting P [LLM] goshs process deletes or renames served files while launched with --no-delete (impact confirmation) Bespoke actions · alerting DSΣPDDCS [LLM] Hidden PowerShell pulls installer.exe from pixeldrain.com to %Temp% (self-deleting dropper) Bespoke install · alerting DSΣPDDCS [LLM] Vitest Browser Mode node.exe writes/deletes PNG or trace archive outside project into system paths Bespoke actions · alerting DSΣPDDCS [LLM] DIRAC service process deletes or truncates its own logs (anti-forensics post-RCE) Bespoke actions · hunting DSΣPDDCS [LLM] Sha1-Hulud destructive wiper fallback (cipher /W, recursive del, shred over home dir) Bespoke actions · alerting DSΣPDDCS [LLM] Package-manager dropper self-deletion inside node_modules (evidence erasure) Bespoke actions · hunting DSΣPDDCS [LLM] easy-day-js malicious setup.cjs written/deleted under node_modules Bespoke delivery · alerting DSΣPDDCS [LLM] Node.js writing a random 24-hex-char .js dropper to the OS temp directory Bespoke install · hunting DSΣPDDCS [LLM] Mastra easy-day-js second-stage stealer payload by SHA256 Bespoke install · hunting DSΣPDDCS [LLM] Orphaned process (ppid=1) executing from /tmp hidden hex path (post-dropper stage-2) Bespoke actions · alerting DSΣPDDCS [LLM] Trinny marker file creation (.trinny-security-update) Bespoke install · alerting DSΣPDDCS [LLM] npm/PyPI dropper self-cleanup: find rm -rf of kube-health-tools in node_modules Bespoke install · alerting DSΣPDD [LLM] plain-crypto-js setup.js self-deletion or package.json overwrite (anti-forensics) Bespoke actions · hunting DSΣPDDCS [LLM] SuiteCRM upload/files .htaccess deleted by web-server process (PHAR gadget) Bespoke actions · alerting DSΣPCS

Articles citing this technique (19)

crit [GHSA / CRITICAL] CVE-2026-64863: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite art-35
crit Email threat landscape: Q2 2026 trends and insights art-108
crit [GHSA / CRITICAL] GHSA-p63j-vcc4-9vmv: @vitest/browser: Browser Mode provider commands bypass the file-access permission gate art-128
crit HelloNet campaign: new malicious modules launched through the ViPNet update system art-152
crit [GHSA / CRITICAL] CVE-2026-61667: DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval art-190
high GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps art-197
crit Secure Registry now tells you which machine pulled a compromised package art-271
high Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat art-314
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-322
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-325
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-371
crit Webworm: New burrowing techniques art-413
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-455
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-475
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-489
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-523
crit EDR killers explained: Beyond the drivers art-577
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-773
high SuiteCRM: PHAR deserialization vulnerability to code execution art-3165