Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1070.004

T1070.004File Deletion

T1070.004 — File Deletion is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 29 detection use cases covering it and 17 threat-intel articles citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
29Use cases
17Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1070 · Indicator Removal

Use cases covering this technique (29)

Clear Unallocated Sector Using Cipher App ESCU actions · alerting P Linux Account Manipulation Of SSH Config and Keys ESCU actions · hunting P Linux Deletion Of Cron Jobs ESCU actions · hunting P Linux Deletion Of Init Daemon Script ESCU actions · alerting P Linux Deletion Of Services ESCU actions · alerting P Linux Deletion of SSL Certificate ESCU actions · hunting P Linux High Frequency Of File Deletion In Boot Folder ESCU actions · alerting P Linux High Frequency Of File Deletion In Etc Folder ESCU actions · hunting P Linux Indicator Removal Service File Deletion ESCU actions · hunting P Recursive Delete of Directory In Batch CMD ESCU actions · alerting P Sdelete Application Execution ESCU actions · alerting P Windows Default Rdp File Deletion ESCU actions · hunting P Windows Rdp AutomaticDestinations Deletion ESCU actions · hunting P Windows RDP Cache File Deletion ESCU actions · hunting P Windows RDP Server Registry Deletion ESCU actions · hunting P [LLM] Client-side WebDAV MOVE with Overwrite:T header (goshs --no-delete bypass exploitation) Bespoke actions · alerting DSΣPDDCS [LLM] WebDAV DELETE blocked (403) then MOVE succeeds (2xx) — goshs --no-delete bypass signature Bespoke actions · alerting SP [LLM] Vitest Browser Mode node.exe writes/deletes PNG or trace archive outside project into system paths Bespoke actions · alerting DSΣPDDCS [LLM] DIRAC service process deletes or truncates its own logs (anti-forensics post-RCE) Bespoke actions · hunting DSΣPDDCS [LLM] Sha1-Hulud destructive wiper fallback (cipher /W, recursive del, shred over home dir) Bespoke actions · alerting DSΣPDDCS [LLM] Package-manager dropper self-deletion inside node_modules (evidence erasure) Bespoke actions · hunting DSΣPDDCS [LLM] easy-day-js malicious setup.cjs written/deleted under node_modules Bespoke delivery · alerting DSΣPDDCS [LLM] Node.js writing a random 24-hex-char .js dropper to the OS temp directory Bespoke install · hunting DSΣPDDCS [LLM] Mastra easy-day-js second-stage stealer payload by SHA256 Bespoke install · hunting DSΣPDDCS [LLM] Orphaned process (ppid=1) executing from /tmp hidden hex path (post-dropper stage-2) Bespoke actions · alerting DSΣPDDCS [LLM] Trinny marker file creation (.trinny-security-update) Bespoke install · alerting DSΣPDDCS [LLM] npm/PyPI dropper self-cleanup: find rm -rf of kube-health-tools in node_modules Bespoke install · alerting DSΣPDD [LLM] plain-crypto-js setup.js self-deletion or package.json overwrite (anti-forensics) Bespoke actions · hunting DSΣPDDCS [LLM] SuiteCRM upload/files .htaccess deleted by web-server process (PHAR gadget) Bespoke actions · alerting DSΣPCS

Articles citing this technique (17)

crit [GHSA / CRITICAL] CVE-2026-64863: goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite art-184
crit [GHSA / CRITICAL] CVE-2026-73653: @vitest/browser: Browser Mode provider commands bypass the file-access permission gate art-234
crit [GHSA / CRITICAL] CVE-2026-61667: DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + eval art-285
high GitHub Secret Scanning Public Monitoring for Enterprises: Coverage and Gaps art-292
crit Secure Registry now tells you which machine pulled a compromised package art-326
high Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat art-362
high Over 140 popular Mastra npm Packages Hit by Supply Chain Attack art-370
crit A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope art-373
high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-417
crit Webworm: New burrowing techniques art-459
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-500
high Malicious Release of elementary-data PyPI Package Steals Cloud Credentials from Data Engineers art-520
high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-534
crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-568
crit EDR killers explained: Beyond the drivers art-613
crit PlushDaemon compromises network devices for adversary-in-the-middle attacks art-803
high SuiteCRM: PHAR deserialization vulnerability to code execution art-3188