Log in Request a demo

Attack technique

Indicator Removal

Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind.

In short

Indicator Removal is a technique where an attacker deletes or changes the traces that their activity leaves behind. These traces include logs, command histories and file details. The aim is to blend in with normal activity and make the intrusion harder to spot.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Stealth · Step 7 Of 15 In The Attack Chain

  1. MITRE IDT1070ATT&CK technique
  2. Detection4ways to spot itData sources MITRE lists
  3. Defences3ways to stop itSend logs to a remote store · Protect local event files

How it works

Systems record what happens on them. Logs, command histories and file details can all show that something unusual took place. Attackers remove or edit selected records so that their actions are less visible.

They often do not wipe everything. They pick the records that look odd or are likely to draw attention, and leave enough data in place that the system still looks normal.

Where these records live, and what they look like, depends on the platform, so attackers adjust their approach for each one.

This may not stop detection completely, but it can delay it, lower the quality of alerts and make it harder to rebuild a timeline. Removed or changed records may still be recoverable through deeper forensic work. MITRE lists eight sub-techniques: T1070.003 Clear Command History, T1070.004 File Deletion, T1070.005 Network Share Connection Removal, T1070.006 Timestomp, T1070.007 Clear Network Connection History and Configurations, T1070.008 Clear Mailbox Data, T1070.009 Clear Persistence and T1070.010 Relocate Malware.

A real example

  • MITRE ATT&CK lists APT42 as clearing browser history.
  • MITRE ATT&CK lists APT5 as using the THINBLOOD utility to clear SSL VPN log files.
  • MITRE ATT&CK lists BPFDoor as clearing the environment variables of a process by emptying its /proc//environ file.
  • MITRE ATT&CK lists DarkWatchman as able to remove its components from the Registry, stop processes and clear browser history.
  • MITRE ATT&CK lists EVILNUM as having a function called DeleteLeftovers that removes certain traces of the attack.

How to detect

  1. Watch for log and history tampering

    Look for deleted or overwritten logs, shell histories and audit records, especially after a privilege change or a suspicious process starting.

  2. Track changes to persistence and system artifacts

    Monitor sequences where registry entries, scheduled tasks or similar items are deleted or modified after suspicious activity.

  3. Cover each platform and service

    Check for log clearing on endpoints, containers, virtualization hosts and mail systems, including hidden or removed mail rules and audit mailboxes.

  4. Data sources MITRE lists

    Application Log Content, File Deletion, File Metadata, File Modification, Scheduled Job Modification, Windows Registry Key Modification

How to defend

  1. Send logs to a remote store

    Forward events automatically to a log server or data repository so an attacker cannot easily find and alter them on the local system. Keep the delay short.

  2. Protect local event files

    Use proper permissions and authentication on locally stored event files, and prevent privilege escalation that would let attackers get around them.

  3. Obfuscate or encrypt event files

    Encrypt event files on the system and in transit so that they give an attacker less feedback.

Questions

What is Indicator Removal (T1070)?

Indicator Removal is a Stealth technique where an attacker deletes or changes the traces their activity leaves behind, such as logs, command histories and file details. The aim is to blend in with normal activity and make the intrusion harder to spot.

Why do attackers delete or change logs?

Systems record what happens on them, and those records can show that something unusual took place. Attackers remove selected records that look odd, which can delay detection, lower the quality of alerts and make it harder to rebuild a timeline.

Can deleted logs be recovered after Indicator Removal?

Sometimes. MITRE notes that removed or changed records may still be recoverable through deeper forensic work. This is one reason to forward logs to a remote store, so a copy exists outside the compromised system.

How can I detect Indicator Removal?

Look for deleted or overwritten logs, shell histories and audit records, especially after a privilege change or a suspicious process starting. Also watch for registry entries or scheduled tasks being deleted or modified after suspicious activity, across endpoints, containers, virtualization hosts and mail systems.

How do I defend against Indicator Removal?

Forward events automatically to a log server or data repository so an attacker cannot easily alter them locally, and keep the delay short. Protect local event files with proper permissions and authentication, and prevent privilege escalation that would let attackers get around them.

In our research

  1. GRU targeting of logistics firms: advisory AA25-141A October 2026
  2. Volt Typhoon advisory AA24-038A: what CISA says October 2026
  3. Salt Typhoon: what telecom customers should do October 2026
  4. APT38: From SWIFT Heists to Crypto Fortresses September 2025
  5. Donex Ransomware Technical Analysis August 2024
  6. KageNoHitobito Ransomware Technical Analysis August 2024

Sources

  1. MITRE ATT&CK T1070: Indicator Removal MITRE
  2. MITRE ATT&CK TA0005: Stealth MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Threat group

APT18

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors. A US health sector briefing (HHS HC3, 2020) lists suspected attribution to China; no advisory, indictment or named sponsor was found.

Read more

Threat group

APT38

APT38 is a North Korean state-sponsored group focused on financial theft, attributed by MITRE ATT&CK to North Korea's Reconnaissance General Bureau. MITRE lists banks, cryptocurrency exchanges and SWIFT system endpoints among its targets. The US Department of Justice named APT38 in November 2025 forfeiture cases over four 2023 cryptocurrency heists.

Read more