[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1070":3},{"item":4,"lessons":18,"controls":61,"related":90},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1070","T1070","Indicator Removal",7,"MITRE","**What attackers do.** Attackers delete or change evidence of their activity, such as event logs, command histories, files, network connection records or email, to avoid detection and slow investigation. This serves the Defence Evasion tactic.\n\n**How to defend.** Forward logs to a central system as they are created so local deletion does not remove them, and restrict who can clear logs. Monitor log clearing and audit policy changes, and protect logging agents from tampering. Retain logs for long enough to support investigation, and alert when an expected source stops sending data.\n\n**Signs to look for.** Look for security log cleared events, gaps in log sequences, deleted shell histories, file timestamps that do not match surrounding activity, and stopped logging services. A common gap is storing logs only on the host being attacked.","Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.\n\nArtifacts such as command histories, log entries, or file metadata may be altered in ways that align with expected user or system activity. Location, format, and type of artifact (such as command or login history) are often platform-specific, allowing adversaries to tailor modifications that minimize suspicion.\n\nThese actions may not prevent detection entirely but can delay recognition of malicious activity or reduce the fidelity of alerts by making events appear benign or consistent with routine operations. Additionally, selectively removed or modified artifacts may still be recoverable through deeper forensic analysis, though their absence or alteration can complicate timeline reconstruction and attribution.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1070\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},10,[21,25,29,33,37,41,45,49,53,57],{"slug":22,"title":23,"published_at":24},"ai-powered-espionage-tool-automates-credential-theft-and-trace-erasure-against-government-networks","AI-Powered Espionage Tool Automates Credential Theft and Trace Erasure Against Government Networks","2026-11-12T15:22:54.034+00:00",{"slug":26,"title":27,"published_at":28},"github-actions-secret-stealer-exploits-stolen-tokens-and-covers-its-tracks","GitHub Actions Secret Stealer Exploits Stolen Tokens and Covers Its Tracks","2026-11-12T08:20:22.031+00:00",{"slug":30,"title":31,"published_at":32},"linux-backdoor-in-cwp-server-evades-logs-via-root-access-abuse","Linux Backdoor in CWP Server Evades Logs via Root Access Abuse","2026-11-06T08:20:46.311+00:00",{"slug":34,"title":35,"published_at":36},"chinese-apt-exploits-beyondtrust-zero-day-to-harvest-credentials-and-exfiltrate-data","Chinese APT Exploits BeyondTrust Zero-Day to Harvest Credentials and Exfiltrate Data","2026-10-16T12:20:53.961+00:00",{"slug":38,"title":39,"published_at":40},"north-korean-apt-deploys-stealthy-linux-toolkit-targeting-south-korean-industries","North Korean APT Deploys Stealthy Linux Toolkit Targeting South Korean Industries","2026-09-07T14:21:39.152+00:00",{"slug":42,"title":43,"published_at":44},"trojanized-haproxy-builds-used-to-hide-north-korean-backdoor","Trojanized HAProxy Builds Used to Hide North Korean Backdoor","2026-09-04T16:20:41.753+00:00",{"slug":46,"title":47,"published_at":48},"incomplete-telemetry-blinds-ai-security-tools-to-sophisticated-attacks","Incomplete Telemetry Blinds AI Security Tools to Sophisticated Attacks","2026-08-27T12:22:34.283+00:00",{"slug":50,"title":51,"published_at":52},"ai-email-assistants-can-be-weaponized-to-hijack-accounts-and-commit-fraud","AI Email Assistants Can Be Weaponized to Hijack Accounts and Commit Fraud","2026-08-04T14:20:22.591+00:00",{"slug":54,"title":55,"published_at":56},"unpatched-pan-os-flaw-opens-door-to-qilin-ransomware-via-vpn-bypass","Unpatched PAN-OS Flaw Opens Door to Qilin Ransomware via VPN Bypass","2026-07-21T16:22:01.799+00:00",{"slug":58,"title":59,"published_at":60},"cisco-sd-wan-zero-day-exploited-for-root-access-before-public-disclosure","Cisco SD-WAN Zero-Day Exploited for Root Access Before Public Disclosure","2026-06-25T06:20:23.206+00:00",[62,67,72,77,81,86],{"slug":63,"name":64,"problem":65,"stories":66},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",8,{"slug":68,"name":69,"problem":70,"stories":71},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",4,{"slug":73,"name":74,"problem":75,"stories":76},"patch-management","Automated patch management","Known holes get closed in days, not months.",3,{"slug":78,"name":79,"problem":80,"stories":76},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",{"slug":82,"name":83,"problem":84,"stories":85},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",2,{"slug":87,"name":88,"problem":89,"stories":85},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[91,97,102,107,111,115,119,123],{"family":92,"item":93,"code":94,"title":95,"together":96},"nist-800-53","au-9","AU-9","Protection of Audit Information",6,{"family":98,"item":99,"code":100,"title":101,"together":96},"cis","13","Control 13","Network Monitoring and Defense",{"family":98,"item":103,"code":104,"title":105,"together":106},"8","Control 8","Audit Log Management",5,{"family":108,"item":109,"code":110,"title":110,"together":106},"itil","overview","ITIL",{"family":92,"item":112,"code":113,"title":114,"together":76},"sc-7","SC-7","Boundary Protection",{"family":98,"item":116,"code":117,"title":118,"together":76},"12","Control 12","Network Infrastructure Management",{"family":98,"item":120,"code":121,"title":122,"together":76},"7","Control 7","Continuous Vulnerability Management",{"family":92,"item":124,"code":125,"title":126,"together":76},"si-2","SI-2","Flaw Remediation"]