T1070: Indicator Removal
AI Answer
Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as (Source: MITRE ATT&CK T1070)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1070 |
| Name | Indicator Removal |
| Tactic | stealth (stealth) |
| Platforms | Containers, ESXi, Linux, macOS, Network Devices, Office Suite, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Indicator Removal (T1070) is one of the highest-connectivity ATT&CK techniques: 33 MITRE STIX relationships reference this technique; 4 threat groups observed using it; 27 software families associated; 2 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1070). Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior. Artifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion. These actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.
Detection
Not available — MITRE ATT&CK does not currently publish a structured detection strategy for this technique in the ingested dataset.
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Software
- Orz
- Stuxnet
- IronWind
- Sardonic
- Bankshot
- DUSTTRAP
- Neoichor
- BlackEnergy
- Rising Sun
- Flagpro
- DarkWatchman
- MultiLayer Wiper
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- Mustang Panda
- APT42
- APT5
- Lazarus Group
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- Cutting Edge
- SolarWinds Compromise
Campaign associations are from MITRE ATT&CK STIX relationships.
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1070 Indicator Removal. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1070 Indicator Removal?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.