Home/ MITRE Matrix/ Defense Evasion/ T1070

T1070Indicator Removal

T1070 — Indicator Removal is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 9 detection use cases covering it and 2 threat-intel articles citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

9Use cases

2Articles

8Sub-techniques

1Tactic

Sub-techniques (8)

T1070.003 · Clear Command History T1070.008 · Clear Mailbox Data T1070.007 · Clear Network Connection History and Configurations T1070.009 · Clear Persistence T1070.004 · File Deletion T1070.005 · Network Share Connection Removal T1070.010 · Relocate Malware T1070.006 · Timestomp

Use cases covering this technique (9)

Cisco ASA - Logging Message Suppression ESCU actions · hunting P ESXi Audit Tampering ESCU actions · alerting P Fsutil Zeroing File ESCU actions · alerting P Linux Indicator Removal Clear Cache ESCU actions · alerting P MacOS Log Removal ESCU actions · alerting P Process Deleting Its Process File Path ESCU actions · alerting P USN Journal Deletion ESCU actions · alerting P Windows Indicator Removal Via Rmdir ESCU actions · hunting P [LLM] AI coding-tool anti-attribution / permission-bypass config artifacts Bespoke install · hunting DSΣPDDCS

Articles citing this technique (2)

crit Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks art-170

crit IR Trends Q2 2026: Phishing and weaponized remote management tools drive attack chains art-188