T1070 Indicator Removal — Detection & Response
Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Location and format of logs are platform or product-specific, however standard operating system logs are captured as Windows Event Logs and Linux/Mac files such as Bash History and /var/log/*.
Coverage at a glance
- Detections shipped
- 4
- Avg. verdict time
- < 5 min
- Data sources
- 4+
Threat context
How adversaries use T1070 Indicator Removal — Detection & Response
Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Location and format of logs are platform or product-specific, however standard operating system logs are captured as Windows Event Logs and Linux/Mac files such as Bash History and /var/log/*.
Windows Event Log clearing (T1070.001) is performed using wevtutil.exe or PowerShell Clear-EventLog and generates a highly reliable detection event (Event ID 1102 for Security log, 104 for System log). Linux command history clearing (T1070.003) via history -c or HISTFILE=/dev/null is common in post-exploitation activity. Timestomping (T1070.006) modifies file metadata to evade timeline analysis during forensic investigation.
Detections ManySignal ships
Ready-to-deploy detection rules
| Rule name | Severity | Data source |
|---|---|---|
| Security Log Cleared — Event ID 1102 on Windows endpoint The Windows Security event log was cleared, a strong indicator of attacker anti-forensics activity. | Critical | Windows Event Log |
| Linux History File Cleared — Shell history deletion or HISTFILE redirect Shell command history cleared or redirected to /dev/null, covering attacker command traces. | High | Linux Audit Log / CrowdStrike |
| wevtutil Log Clear Command — wevtutil.exe cl invocation wevtutil.exe executed with the 'cl' (clear) subcommand, clearing Windows event logs. | Critical | CrowdStrike / SentinelOne |
| S3 Object Deletion Spike — Bulk object deletion in CloudTrail log bucket Large number of S3 DeleteObject calls targeting a CloudTrail log bucket, consistent with log tampering. | Critical | AWS CloudTrail |
Related techniques and tactics
T1078 Valid Accounts — Detection & Response
ATT&CK Technique
T1110 Brute Force — Detection & Response
ATT&CK Technique
T1566 Phishing — Detection & Response
ATT&CK Technique
T1059 Command and Scripting Interpreter — Detection & Response
ATT&CK Technique
T1053 Scheduled Task/Job — Detection & Response
ATT&CK Technique
T1548 Abuse Elevation Control Mechanism — Detection & Response
ATT&CK Technique
T1068 Exploitation for Privilege Escalation — Detection & Response
ATT&CK Technique
T1134 Access Token Manipulation — Detection & Response
ATT&CK Technique
T1098 Account Manipulation — Detection & Response
ATT&CK Technique
T1136 Create Account — Detection & Response
ATT&CK Technique
T1556 Modify Authentication Process — Detection & Response
ATT&CK Technique
T1621 Multi-Factor Authentication Request Generation — Detection & Response
ATT&CK Technique
T1070 Indicator Removal — Detection & Response: frequently asked questions
If an attacker clears logs, does ManySignal lose historical context?
No. ManySignal ingests logs as they are generated. Clearing local Windows Event Logs removes the local copy but does not remove events already sent to ManySignal. The act of clearing logs is itself logged (Event ID 1102) and generates a high-priority ManySignal alert.
See the agentic SOC in action
Watch AI agents work a real alert queue — verdicts, evidence, and confidence scores included. In-house SOC or MDR, your call.