Indicator Removal `T1070`

Tactic: Stealth

Adversaries may selectively delete or modify artifacts generated to reduce indications of their presence and blend in with legitimate activity. Rather than broadly removing evidence, adversaries may target specific artifacts that appear anomalous or are likely to draw scrutiny, while leaving sufficient data intact to maintain the appearance of normal system behavior.

Events covered

24 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 2	A process changed a file creation time
Sysmon	Event ID 7	Image loaded
Sysmon	Event ID 12	RegistryEvent (Object create and delete)
Sysmon	Event ID 13	RegistryEvent (Value Set)
Sysmon	Event ID 14	RegistryEvent (Key and Value Rename)
Sysmon	Event ID 23	FileDelete (File Delete archived)
Sysmon	Event ID 26	FileDeleteDetected (File Delete logged)
Security-Auditing	Event ID 4616	The system time was changed.
Security-Auditing	Event ID 4656	A handle to an object was requested.
Security-Auditing	Event ID 4658	The handle to an object was closed.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4719	System audit policy was changed.
Defender-DeviceProcessEvents	any	Process activity (any)
ESF	exec	Process Execution (Notify)
Linux-Auditd	Event ID 1309	EXECVE
Backup	Event ID 524	The system catalog has been deleted.
Eventlog	Event ID 104	The LogFileCleared.Channel log file was cleared.
Eventlog	Event ID 1102	The audit log was cleared.
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800	Event ID 800
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

Patterns shared across the 176 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (106 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`CommandLine`	38	`contains` 31, `ends_with` 4, `match` 3, `regex_match` 3, `in` 2	`-n` , `del`, `(?i)\s(execcmd\|runinteractive(cmd)?\|savescreenshot(full\|w...`, `-r`, `.service`
`TargetFilename`	32	`ends_with` 12, `starts_with` 11, `contains` 6, `wildcard` 6, `in` 5	`.log`, `/dev/shm/*`, `/etc/`, `/etc/ssl/certs/`, `:zone.identifier`
`Image`	27	`ends_with` 22, `eq` 3, `starts_with` 3, `is_not_null` 1	`\cmd.exe`, `/rm`, `/shred`, `/touch`, `\fltmc.exe`
`process_name`	26	`eq` 19, `in` 3, `match` 2, `ends_with` 1, `starts_with` 1	`powershell.exe`, `fsutil.exe`, `(?i)nircmd\.exe`, `bash`, `cmd.exe`
`event.type`	22	`eq` 22	`start`, `deletion`, `change`
`EventType`	20	`eq` 11, `in` 9	`exec`, `exec_event`, `ProcessRollup2`, `creation`, `deletion`
`OriginalFileName`	20	`eq` 19, `in` 3	`cmd.exe`, `powershell.exe`, `powershell_ise.exe`, `pwsh.dll`, `fltmc.exe`
`EventID`	15	`eq` 12, `in` 3	`23`, `4104`, `1102`, `26`, `4103`
`ScriptBlockText`	14	`contains` 13, `ends_with` 1, `eq` 1, `match` 1	`(get-psreadlineoption).historysavepath`, `clear-eventlog`, `-adjust`, `-date`, `-historysavestyle`
`process.args`	12	`eq` 7, `in` 4, `starts_with` 4, `contains` 2, `wildcard` 2, `match` 1	`-c`, `+o`, `Remove-Item`, `]::Delete(`, `del `
`host.os.type`	11	`eq` 11
`sourcetype`	11	`eq` 9, `in` 6	`o365:management:activity`, `ms:o365:reporting:messagetrace`, `o365:reporting:messagetrace`, `cisco:asa`, `vmw-syslog`
`EventId`	10	`in` 6, `eq` 4	`1003`, `1026`, `1028`, `1029`, `1040`
`event_action`	7	`eq` 7	`deleted`
`Operation`	6	`eq` 4, `in` 2, `starts_with` 2	`HardDelete`, `send`, `Send`, `SendAs`, `SendOnBehalf`

Top indicator values (874 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticClearing Windows Console History elasticClearing Windows Event Logs elasticDelete Volume USN Journal with Fsutil elasticDisable Windows Event and Security Logs Using Built-in Tools elasticESXI Timestomping using Touch Command elasticFile Creation, Execution and Self-Deletion in Suspicious Directory elasticFile Deletion via Shred elasticFile or Directory Deletion Command elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers elasticShell Command-Line History Deletion Detected via Defend for Containers elasticShell History Clearing via Environment Variables elasticTampering of Shell Command-Line History elasticTimestomping using Touch Command	15	606
`event.type`	`eq`	`deletion` elasticPotential REMCOS Trojan Execution elasticShell Command-Line History Deletion Detected via Defend for Containers elasticSSH Authorized Keys File Deletion elasticSSL Certificate Deletion elasticSuspicious Print Spooler File Deletion elasticSystem Log File Deletion elasticWebServer Access Logs Deleted	7	9
`OriginalFileName`	`eq`	`cmd.exe` sigmaDirectory Removal Via Rmdir sigmaFile Deletion Via Del sigmaGreedy File Deletion Using Del sigmaIIS WebServer Log Deletion via CommandLine Utilities sigmaPotentially Suspicious Ping/Copy Command Combination elasticFile or Directory Deletion Command splunkRecursive Delete of Directory In Batch CMD	7	65
`OriginalFileName`	`eq`	`powershell.exe` sigmaIIS WebServer Log Deletion via CommandLine Utilities sigmaShadow Copies Deletion Using Operating Systems Utilities elasticFile or Directory Deletion Command	3	120
`event_action`	`eq`	`deleted` splunkLinux Account Manipulation Of SSH Config and Keys splunkLinux Deletion Of Cron Jobs splunkLinux Deletion Of Init Daemon Script splunkLinux Deletion Of Services splunkLinux Deletion of SSL Certificate splunkLinux High Frequency Of File Deletion In Boot Folder splunkLinux High Frequency Of File Deletion In Etc Folder	7	7
`EventType`	`eq`	`exec` sigmamacOS Data Destruction Tools elasticFile Creation, Execution and Self-Deletion in Suspicious Directory elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers elasticShell Command-Line History Deletion Detected via Defend for Containers elasticShell History Clearing via Environment Variables elasticTimestomping using Touch Command	6	171
`Workload`	`eq`	`Exchange` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Password and Payroll Compromise Behavior splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior splunkO365 Email Send Attachments Excessive Volume	6	20
`sourcetype`	`eq`	`o365:management:activity` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Password and Payroll Compromise Behavior splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior splunkO365 Email Send Attachments Excessive Volume	6	80
`EventType`	`in`	`exec` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred elasticTampering of Shell Command-Line History	5	171
`EventType`	`in`	`exec_event` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred elasticTampering of Shell Command-Line History	5	139
`EventType`	`in`	`executed` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred elasticTampering of Shell Command-Line History	5	88
`EventType`	`in`	`process_started` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred elasticTampering of Shell Command-Line History	5	74
`EventType`	`in`	`ProcessRollup2` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred	4	117
`EventType`	`in`	`start` elasticAttempt to Clear Kernel Ring Buffer elasticAttempt to Clear Logs via Journalctl elasticESXI Timestomping using Touch Command elasticFile Deletion via Shred	4	134
`Image`	`ends_with`	`\cmd.exe` sigmaDirectory Removal Via Rmdir sigmaFile Deletion Via Del sigmaGreedy File Deletion Using Del sigmaIIS WebServer Log Deletion via CommandLine Utilities sigmaPotentially Suspicious Ping/Copy Command Combination	5	130
`CommandLine`	`contains`	`del` sigmaFile Deletion Via Del sigmaGreedy File Deletion Using Del sigmaIIS WebServer Log Deletion via CommandLine Utilities sigmaSuspicious Ping/Del Command Combination	4	5
`CommandLine`	`contains`	`cl` sigmaETW Trace Evasion Activity sigmaEvent log clear attempt (command) kustoClearing of forensic evidence from event logs using wevtutil	3	3
`CommandLine`	`contains`	`erase` sigmaFile Deletion Via Del sigmaGreedy File Deletion Using Del sigmaIIS WebServer Log Deletion via CommandLine Utilities	3	3
`CommandLine`	`contains`	`rm` sigmaIIS WebServer Log Deletion via CommandLine Utilities splunkLinux Indicator Removal Service File Deletion splunkMacOS Log Removal	3	4
`EventID`	`eq`	`4104` splunkETW Trace Provider Modified - PowerShell (PowerShell) splunkNetwork Share Connection Removal (PowerShell) splunkTimestamp Manipulation (PowerShell) splunkWindows Powershell History File Deletion	4	268
`EventID`	`eq`	`1102` splunkClear Windows Event Logs (Windows Event Log) kustoNRT Security Event log cleared kustoSecurity Event log cleared	3	4
`EventID`	`eq`	`4103` splunkETW Trace Provider Modified - PowerShell (PowerShell) splunkNetwork Share Connection Removal (PowerShell) splunkTimestamp Manipulation (PowerShell)	3	105
`Operation`	`eq`	`HardDelete` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior	4	4
`m365::Folder.Path`	`in`	`\\Recoverable Items\\Deletions` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior	4	4
`m365::Folder.Path`	`in`	`\\Sent Items` splunkO365 Email Hard Delete Excessive Volume splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send and Hard Delete Suspicious Behavior	4	4
`process_name`	`eq`	`powershell.exe` elasticClearing Windows Console History elasticClearing Windows Event Logs elasticDisable Windows Event and Security Logs Using Built-in Tools elasticFile or Directory Deletion Command	4	104
`sourcetype`	`in`	`ms:o365:reporting:messagetrace` splunkO365 Email Password and Payroll Compromise Behavior splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send Attachments Excessive Volume	4	4
`sourcetype`	`in`	`o365:reporting:messagetrace` splunkO365 Email Password and Payroll Compromise Behavior splunkO365 Email Receive and Hard Delete Takeover Behavior splunkO365 Email Send and Hard Delete Exfiltration Behavior splunkO365 Email Send Attachments Excessive Volume	4	4
`EventID`	`in`	`23` splunkWindows ConsoleHost History File Deletion splunkWindows Default Rdp File Deletion splunkWindows RDP Cache File Deletion	3	6
`EventID`	`in`	`26` splunkWindows ConsoleHost History File Deletion splunkWindows Default Rdp File Deletion splunkWindows RDP Cache File Deletion	3	6

Exclusions (196 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Field	Kind	Value	Rules excluding
`Image`	`in`	`/usr/bin/podman` elasticSSL Certificate Deletion elasticSystem Log File Deletion	2
`process_name`	`in`	`conftest` elasticFile Creation, Execution and Self-Deletion in Suspicious Directory elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers	2
`process_name`	`in`	`dockerd` elasticSSL Certificate Deletion elasticSystem Log File Deletion	2
`process_name`	`in`	`gcc` elasticFile Creation, Execution and Self-Deletion in Suspicious Directory elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers	2
`process_name`	`in`	`getarch` elasticFile Creation, Execution and Self-Deletion in Suspicious Directory elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers	2
`process_name`	`in`	`ld` elasticFile Creation, Execution and Self-Deletion in Suspicious Directory elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers	2
`process_name`	`in`	`link` elasticFile Creation, Execution and Self-Deletion in Suspicious Directory elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers	2
`process_name`	`in`	`rm` elasticFile Creation, Execution and Self-Deletion in Suspicious Directory elasticIngress Tool Transfer Followed by Execution and Deletion Detected via Defend for Containers	2
`CommandLine`	`ends_with`	`unload DFMFilter` sigmaFilter Driver Unloaded Via Fltmc.EXE	1
`CommandLine`	`ends_with`	`unload rtp_filesystem_filter` sigmaFilter Driver Unloaded Via Fltmc.EXE	1
`CommandLine`	`ends_with`	`unload rtp_filter` sigmaFilter Driver Unloaded Via Fltmc.EXE	1
`CommandLine`	`eq`	`stat -c %s history` elasticTampering of Shell Command-Line History	1
`CommandLine`	`in`	`/bin/touch -a /tmp/au_status` elasticTimestomping using Touch Command	1
`CommandLine`	`in`	`touch -d 2 seconds ago /etc/postfix/main.cf` elasticTimestomping using Touch Command	1
`CreationUtcTime`	`starts_with`	`202` sigmaFile Creation Date Changed to Another Year	1

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Indicator Removal `T1070`

Events covered

Authoring guide

Fields filtered most (106 distinct)

Top indicator values (874 distinct)

Exclusions (196 distinct)

Rules under this technique

Sigma 62 rules

Elastic 32 rules

Splunk 42 rules

Kusto 29 rules

YARA-L 1 rule

Panther 10 rules

Keyboard shortcuts

Search operators

Indicator Removal T1070

Events covered

Authoring guide

Fields filtered most (106 distinct)

Top indicator values (874 distinct)

Exclusions (196 distinct)

Rules under this technique

Sigma 62 rules

Elastic 32 rules

Splunk 42 rules

Kusto 29 rules

YARA-L 1 rule

Panther 10 rules

Indicator Removal `T1070`