Indicator Removal `T1070`

Tactic: Stealth

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.

Events covered

29 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 2	A process changed a file creation time
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 23	FileDelete (File Delete archived)
Sysmon	Event ID 26	FileDeleteDetected (File Delete logged)
Security-Auditing	Event ID 4616	The system time was changed.
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4658	The handle to an object was closed.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4719	System audit policy was changed.
Defender-AlertEvidence	any	Alert evidence
Defender-AlertInfo	any	Alert information
Defender-DeviceLogonEvents	any	Logon activity
Defender-DeviceProcessEvents	any	Process activity
ESF	exec	Process Execution
ESF	unlink	File Unlink
Linux-Auditd	Event ID 1309	EXECVE
Linux-Auditd	Event ID 1327	PROCTITLE
Backup	Event ID 524	The system catalog has been deleted.
Eventlog	Event ID 104	The LogFileCleared.Channel log file was cleared.
Eventlog	Event ID 1102	The audit log was cleared.
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800	Event ID 800
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

These 204 rules share fields, values, and exclusions.

Fields filtered most (110 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`CommandLine`	40	`contains` 31, `regex_match` 7, `ends_with` 4, `in` 2	`-n` , `(?i)\s(execcmd\|runinteractive(cmd)?\|savescreenshot(full\|w...`, `rm `, `delete`, `unload`
`EventType`	40	`eq` 30, `in` 12	`exec`, `deletion`, `exec_event`, `ProcessRollup2`, `creation`
`TargetFilename`	40	`starts_with` 15, `ends_with` 12, `wildcard` 9, `contains` 6, `in` 6	`.log`, `/dev/shm/`, `/etc/`, `/etc/ssl/certs/`, `/home//*`
`event.type`	40	`eq` 40, `in` 1	`start`, `deletion`, `change`, `group`, `user`
`Image`	37	`ends_with` 23, `starts_with` 8, `eq` 4, `is_not_null` 3, `wildcard` 3	`/dev/shm/`, `\cmd.exe`, , `./`, `/boot/*`
`process_basename`	36	`eq` 25, `in` 9, `starts_with` 6	`bash`, `powershell.exe`, `.*`, `busybox`, `cmd.exe`
`OriginalFileName`	20	`eq` 19, `in` 3	`Cmd.Exe`, `PowerShell.EXE`, `fltMC.exe`, `fsutil.exe`, `net1.exe`
`process.args`	20	`eq` 8, `in` 7, `starts_with` 6, `wildcard` 6, `contains` 3, `regex_match` 1	`--clear`, `--read-clear`, `--vacuum-files=`, `+o`, `--date=`
`EventID`	16	`eq` 12, `in` 4	`23`, `26`, `4104`, `1102`, `4103`
`ScriptBlockText`	14	`contains` 13, `ends_with` 1, `eq` 1, `match` 1	`(Get-PSReadlineOption).HistorySavePath`, `Clear-EventLog`, `.HistorySavePath`, `Remove-Item*`, `-Adjust`
`sourcetype`	13	`eq` 11, `in` 6	`o365:management:activity`, `ms:o365:reporting:messagetrace`, `o365:reporting:messagetrace`, `bash_history`, `cisco:asa`
`EventId`	10	`in` 6, `eq` 4	`1003`, `1026`, `1028`, `1029`, `1040`
`event_action`	7	`eq` 7	`deleted`
`file.extension`	7	`eq` 5, `in` 2	`dll`, `js`, `py`, `crt`, `exe`
`Operation`	6	`eq` 4, `in` 2, `starts_with` 2	`HardDelete`, `Send*`, `Send`, `SendAs`, `SendOnBehalf`

Top indicator values (1125 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Kernel Ring Buffer via Dmesg elasticAttempt to Clear Logs via Journalctl elasticAttempt to Clear Logs via Journalctl elasticClearing of Shell History via Environment Variables elasticClearing Windows Console History elasticClearing Windows Event Logs elasticDelete Volume USN Journal with Fsutil elasticDisable Windows Event and Security Logs Using Built-in Tools elasticESXI Timestomping using Touch Command elasticFile Creation, Execution and Self-Deletion in Suspicious Directory elasticFile Deletion via Shred elasticFile or Directory Deletion Command elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers elasticLoadable Kernel Module Load Followed by Log Clearing +14 more rules	29	1036
`event.type`	`eq`	`deletion` elasticDeletion of Shell History File elasticLinux User or Group Deletion elasticMultiple System Log Files Deletion elasticPotential REMCOS Trojan Execution elasticShell Command-Line History Deletion Detected via Defend for Containers elasticSSH Authorized Keys File Deletion elasticSSH Authorized Keys File Deletion elasticSSL Certificate Deletion elasticSuspicious Print Spooler File Deletion elasticSystem Log File Deletion elasticUser Session File Deletion elasticWebServer Access Logs Deleted	12	16
`EventType`	`eq`	`exec` elasticAttempt to Clear Kernel Ring Buffer via Dmesg elasticAttempt to Clear Logs via Journalctl elasticClearing of Shell History via Environment Variables elasticFile Creation, Execution and Self-Deletion in Suspicious Directory elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers elasticLoadable Kernel Module Load Followed by Log Clearing elasticProcess Execution Followed by Self-Deletion elasticProcess Execution Followed by Self-Deletion elasticSelf-Deleted Python Script Outbound Network Connection elasticSelf-Deleting Python Script elasticShell Command-Line History Deletion Detected via Defend for Containers elasticShell History Clearing via Environment Variables elasticSSH Authorized Keys File Deletion elasticTampering of Bash Command-Line History elasticTimestomping Detected via Touch +2 more rules	17	547
`EventType`	`eq`	`deletion` elasticFile Creation, Execution and Self-Deletion in Suspicious Directory elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers elasticNode Script Execution and Immediate Deletion elasticNode Script Execution and Immediate Deletion elasticProcess Execution Followed by Self-Deletion elasticProcess Execution Followed by Self-Deletion elasticPython Library Load and Delete elasticSelf-Deleted Python Script Outbound Network Connection elasticSelf-Deleting Python Script elasticSuspicious PowerShell Console History Deletion elasticUnsigned or Untrusted Process Execution and Immediate Self-Deletion	11	13
`EventType`	`in`	`exec` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred elasticNode Script Execution and Immediate Deletion elasticNode Script Execution and Immediate Deletion elasticTampering of Shell Command-Line History	7	180
`EventType`	`in`	`start` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred elasticNode Script Execution and Immediate Deletion elasticNode Script Execution and Immediate Deletion	6	157
`EventType`	`in`	`exec_event` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred elasticTampering of Shell Command-Line History	5	135
`EventType`	`in`	`executed` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred elasticTampering of Shell Command-Line History	5	85
`EventType`	`in`	`process_started` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred elasticTampering of Shell Command-Line History	5	77
`EventType`	`in`	`ProcessRollup2` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred	4	119
`OriginalFileName`	`eq`	`Cmd.Exe` sigmaDirectory Removal Via Rmdir sigmaFile Deletion Via Del sigmaGreedy File Deletion Using Del sigmaIIS WebServer Log Deletion via CommandLine Utilities sigmaPotentially Suspicious Ping/Copy Command Combination elasticFile or Directory Deletion Command splunkRecursive Delete of Directory In Batch CMD	7	75
`event_action`	`eq`	`deleted` splunkLinux Account Manipulation Of SSH Config and Keys splunkLinux Deletion Of Cron Jobs splunkLinux Deletion Of Init Daemon Script splunkLinux Deletion Of Services splunkLinux Deletion of SSL Certificate splunkLinux High Frequency Of File Deletion In Boot Folder splunkLinux High Frequency Of File Deletion In Etc Folder	7	8
`Image`	`ends_with`	`*\cmd.exe` sigmaDirectory Removal Via Rmdir sigmaFile Deletion Via Del sigmaGreedy File Deletion Using Del sigmaIIS WebServer Log Deletion via CommandLine Utilities sigmaPotentially Suspicious Ping/Copy Command Combination splunkProcess Deleting Its Process File Path	6	132
`Workload`	`eq`	`Exchange` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Password and Payroll Compromise Behavior splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior splunkO365 Email Send Attachments Excessive Volume	6	20
`sourcetype`	`eq`	`o365:management:activity` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Password and Payroll Compromise Behavior splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior splunkO365 Email Send Attachments Excessive Volume	6	80
`CommandLine`	`contains`	`del` sigmaFile Deletion Via Del sigmaGreedy File Deletion Using Del sigmaIIS WebServer Log Deletion via CommandLine Utilities sigmaSuspicious Ping/Del Command Combination	4	5
`EventID`	`eq`	`4104` splunkETW Trace Provider Modified - PowerShell (PowerShell) splunkNetwork Share Connection Removal (PowerShell) splunkTimestamp Manipulation (PowerShell) splunkWindows Powershell History File Deletion	4	269
`EventID`	`in`	`23` splunkWindows ConsoleHost History File Deletion splunkWindows Default Rdp File Deletion splunkWindows Rdp AutomaticDestinations Deletion splunkWindows RDP Cache File Deletion	4	10
`EventID`	`in`	`26` splunkWindows ConsoleHost History File Deletion splunkWindows Default Rdp File Deletion splunkWindows Rdp AutomaticDestinations Deletion splunkWindows RDP Cache File Deletion	4	10
`Operation`	`eq`	`HardDelete` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior	4	4
`event.outcome`	`eq`	`success` elasticAWS S3 Bucket Expiration Lifecycle Configuration Added elasticAWS SES Email Identity Verified Then Deleted elasticLinux User or Group Deletion elasticM365 Exchange MFA Notification Email Deleted or Moved	4	82
`m365::Folder.Path`	`in`	`\Recoverable Items\Deletions` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior	4	4
`m365::Folder.Path`	`in`	`\Sent Items` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior	4	4
`process_basename`	`eq`	`powershell.exe` elasticClearing Windows Console History elasticClearing Windows Event Logs elasticDisable Windows Event and Security Logs Using Built-in Tools elasticFile or Directory Deletion Command	4	187
`process_basename`	`in`	`bash` elasticDeletion of Shell History File elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers elasticSSH Authorized Keys File Deletion elasticTampering of Bash Command-Line History	4	181
`process_basename`	`in`	`csh` elasticDeletion of Shell History File elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers elasticSSH Authorized Keys File Deletion elasticTampering of Bash Command-Line History	4	148
`process_basename`	`in`	`fish` elasticDeletion of Shell History File elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers elasticSSH Authorized Keys File Deletion elasticTampering of Bash Command-Line History	4	151
`process_basename`	`in`	`ksh` elasticDeletion of Shell History File elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers elasticSSH Authorized Keys File Deletion elasticTampering of Bash Command-Line History	4	149
`process_basename`	`in`	`sh` elasticDeletion of Shell History File elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers elasticSSH Authorized Keys File Deletion elasticTampering of Bash Command-Line History	4	180
`process_basename`	`in`	`tcsh` elasticDeletion of Shell History File elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers elasticSSH Authorized Keys File Deletion elasticTampering of Bash Command-Line History	4	145

Exclusions (440 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`CommandLine`	`in`	`/bin/touch -a /tmp/au_status` elasticTimestomping Detected via Touch elasticTimestomping using Touch Command	2
`CommandLine`	`in`	`touch -d 2 seconds ago /etc/postfix/main.cf` elasticTimestomping Detected via Touch elasticTimestomping using Touch Command	2
`CurrentDirectory`	`in`	`/opt/libexec` elasticTimestomping Detected via Touch elasticTimestomping using Touch Command	2
`CurrentDirectory`	`in`	`/opt/local/src/connectxx/build/src/mdp` elasticTimestomping Detected via Touch elasticTimestomping using Touch Command	2
`Image`	`eq`	`/actions-runner/externals/node24/bin/node` elasticNode Script Execution and Immediate Deletion elasticNode Script Execution and Immediate Deletion	2
`Image`	`in`	`/usr/bin/podman` elasticSSL Certificate Deletion elasticSystem Log File Deletion	2
`Image`	`starts_with`	`C:\Program Files (x86)\` sigmaAccess To Windows Outlook Mail Files By Uncommon Applications sigmaFile Creation Date Changed to Another Year	2
`Image`	`starts_with`	`C:\Program Files\` sigmaAccess To Windows Outlook Mail Files By Uncommon Applications sigmaFile Creation Date Changed to Another Year	2
`Image`	`starts_with`	`C:\WINDOWS\System32\` sigmaAccess To Windows Outlook Mail Files By Uncommon Applications sigmaFile Creation Date Changed to Another Year	2
`Image`	`wildcard`	`?:\Windows\SysWOW64\msiexec.exe` elasticPotential Image Load with a Spoofed Creation Time elasticPotential Timestomp in Executable Files	2
`Image`	`wildcard`	`?:\Windows\system32\msiexec.exe` elasticPotential Image Load with a Spoofed Creation Time elasticPotential Timestomp in Executable Files	2
`ParentCommandLine`	`eq`	`runc init` elasticTimestomping Detected via Touch elasticTimestomping using Touch Command	2
`ParentImage`	`eq`	`/tmp/newroot/usr/bin/sudo` elasticAttempt to Clear Kernel Ring Buffer via Dmesg elasticAttempt to Clear Logs via Journalctl	2
`ParentImage`	`in`	`/bin/dracut` elasticTimestomping Detected via Touch elasticTimestomping using Touch Command	2
`ParentImage`	`in`	`/bin/ssm-agent-worker` elasticTimestomping Detected via Touch elasticTimestomping using Touch Command	2

Indicator Removal `T1070`

Events covered

Authoring guide

Fields filtered most (110 distinct)

Top indicator values (1125 distinct)

Exclusions (440 distinct)

Rules under this technique

Sigma 64 rules

Elastic 55 rules

Splunk 46 rules

Kusto 29 rules

YARA-L 1 rule

Panther 9 rules

Indicator Removal T1070

Events covered

Authoring guide

Fields filtered most (110 distinct)

Top indicator values (1125 distinct)

Exclusions (440 distinct)

Rules under this technique

Sigma 64 rules

Elastic 55 rules

Splunk 46 rules

Kusto 29 rules

YARA-L 1 rule

Panther 9 rules

Indicator Removal `T1070`