Indicator Removal on Host

Adversaries may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware. Locations and format of logs are platform or product-specific, however standard operating system logs are captured as Windows events or Linux/macOS files such as Bash History and /var/log/*.

These actions may interfere with event collection, reporting, or other notifications used to detect intrusion activity. This that may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

ID: T1070
Tactic: Defense Evasion
Platforms: Linux, Windows, macOS
Data Sources: API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Defense Bypassed: Anti-virus, Host intrusion prevention systems, Log analysis
Contributors: Ed Williams, Trustwave, SpiderLabs
Version: 1.1
Created: 31 May 2017
Last Modified: 16 October 2020

Procedure Examples

Name Description

Bankshot deletes all artifacts associated with the malware from the infected machine.[1]


Goopy has the ability to delete emails used for C2 once the content has been copied.[2]


Maze has used the "Wow64RevertWow64FsRedirection" function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.[3]


MCMD has the ability to remove set Registry Keys.[4]


Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.[5]


Misdat is capable of deleting Registry keys used for persistence.[6]


njRAT is capable of deleting objects related to itself (registry keys, files, and firewall rules) on the victim.[7][8]


Orz can overwrite Registry settings to reduce its visibility on the victim.[9]


Pillowmint can uninstall the malicious service from an infected machine.[10]


PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.[11]


After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.[12]

Rising Sun

Rising Sun can clear process memory by overwriting it with junk bytes.[13]


RTM has the ability to remove Registry entries that it created during execution.[14]


SDBot has the ability to clean up and remove data structures from a compromised host.[15]


Sunburst removed IFEO values to clean up traces of execution.[16]


UNC2452 removed evidence of email export requests using Remove-MailboxExportRequest.[17] They temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.[18]


Mitigation Description
Encrypt Sensitive Information

Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.

Remote Data Storage

Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system. When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

Restrict File and Directory Permissions

Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.


File system monitoring may be used to detect improper deletion or modification of indicator files. Events not stored on the file system may require different detection mechanisms.